[{"data":1,"prerenderedAt":289},["ShallowReactive",2],{"blog-has-posts":3,"current-release":4,"legal:\u002Flegal\u002Fdisclosure":5,"legal-nav":266},false,"1.1.0",{"id":6,"title":7,"body":8,"description":257,"extension":258,"meta":259,"navigation":260,"path":261,"seo":262,"stem":263,"updatedAt":264,"__hash__":265},"legal\u002Flegal\u002Fdisclosure.md","Reporting a Vulnerability",{"type":9,"value":10,"toc":245},"minimark",[11,25,30,72,76,114,118,132,136,147,151,158,161,165,235,238,242],[12,13,14,15,20,21,24],"p",{},"Report anything you find to ",[16,17,19],"a",{"href":18},"mailto:security@katami.io","security@katami.io",".\nThis policy is also published at\n",[16,22,23],{"href":23},"\u002F.well-known\u002Fsecurity.txt",", per RFC 9116.",[26,27,29],"h2",{"id":28},"in-scope","In scope",[31,32,33,41,51,61],"ul",{},[34,35,36,40],"li",{},[37,38,39],"strong",{},"The Katami app for macOS"," — the current release and the current beta.",[34,42,43,46,47,50],{},[37,44,45],{},"katami.io"," and ",[37,48,49],{},"bespokebyte.io",".",[34,52,53,56,57,50],{},[37,54,55],{},"The License Manager"," — ",[58,59,60],"code",{},"licenses.bespokebyte.io",[34,62,63,56,66,46,69,50],{},[37,64,65],{},"Our API",[58,67,68],{},"api.bespokebyte.io",[58,70,71],{},"models.bespokebyte.io",[26,73,75],{"id":74},"out-of-scope","Out of scope",[31,77,78,84,90,96,102,108],{},[34,79,80,83],{},[37,81,82],{},"Services we use but do not run"," — Paddle's checkout and payment pages,\nApple, Resend and Linear. Please report to them directly; Paddle, for one,\nruns its own programme.",[34,85,86,89],{},[37,87,88],{},"Findings with no demonstrated impact"," — missing headers or \"best\npractices\", outdated libraries, or scanner output without a working proof of\nconcept.",[34,91,92,95],{},[37,93,94],{},"Denial of service"," and volumetric testing of any kind.",[34,97,98,101],{},[37,99,100],{},"Social engineering"," of us, our customers, or anyone else, and physical\nattacks.",[34,103,104,107],{},[37,105,106],{},"Email configuration reports"," (SPF, DKIM, DMARC) without a demonstrated\nspoof that reaches an inbox.",[34,109,110,113],{},[37,111,112],{},"Account enumeration"," through sign-in. Our sign-in says whether an address\nholds a license, deliberately, so a customer who typed the wrong address is\ntold so.",[26,115,117],{"id":116},"please","Please",[31,119,120,123,126,129],{},[34,121,122],{},"Test only against your own license, your own Macs and your own data.",[34,124,125],{},"Stop as soon as you reach data that is not yours, do not keep it, and tell us.",[34,127,128],{},"Give us a reasonable chance to fix the issue before telling anyone else.",[34,130,131],{},"Include enough detail for us to reproduce it — steps, a proof of concept, and\nthe versions involved.",[26,133,135],{"id":134},"please-do-not","Please do not",[31,137,138,141,144],{},[34,139,140],{},"Run automated scanners or brute-forcing tools against production.",[34,142,143],{},"Access, change or delete data that is not yours.",[34,145,146],{},"Degrade the service for anyone else.",[26,148,150],{"id":149},"safe-harbour","Safe harbour",[12,152,153,154,157],{},"If you act in good faith under this policy, ",[37,155,156],{},"we consider your research\nauthorised, we will not pursue or support legal action against you",", and we\nwill not ask your employer or anyone else to. If a third party takes action\nagainst you over research that followed this policy, we will make clear that it\nwas authorised.",[12,159,160],{},"If you are unsure whether something is in scope, ask first. A question costs\nnothing, and this protection is easier to give in advance than to argue about\nafterwards.",[26,162,164],{"id":163},"what-to-expect-from-us","What to expect from us",[166,167,168,179],"table",{},[169,170,171],"thead",{},[172,173,174,177],"tr",{},[175,176],"th",{},[175,178],{},[180,181,182,194,204,216,224],"tbody",{},[172,183,184,188],{},[185,186,187],"td",{},"Acknowledgement",[185,189,190,191],{},"within ",[37,192,193],{},"3 working days",[172,195,196,199],{},[185,197,198],{},"An assessment, with our view of severity",[185,200,190,201],{},[37,202,203],{},"10 working days",[172,205,206,209],{},[185,207,208],{},"Progress updates",[185,210,211,212,215],{},"at least every ",[37,213,214],{},"14 days"," while it is open",[172,217,218,221],{},[185,219,220],{},"Fix, or an explanation of why not",[185,222,223],{},"as fast as the severity warrants",[172,225,226,229],{},[185,227,228],{},"Disclosure",[185,230,231,232],{},"coordinated with you, normally within ",[37,233,234],{},"90 days",[12,236,237],{},"We are a very small team, so those are commitments about communication rather\nthan a promise that every fix is instant. If we are going to miss one, we will\ntell you before it slips rather than afterwards.",[26,239,241],{"id":240},"recognition","Recognition",[12,243,244],{},"We do not run a paid bug-bounty programme. We credit every reporter who wants\nto be named, in the release notes of the fix, and we say plainly what they\nfound.",{"title":246,"searchDepth":247,"depth":247,"links":248},"",3,[249,251,252,253,254,255,256],{"id":28,"depth":250,"text":29},2,{"id":74,"depth":250,"text":75},{"id":116,"depth":250,"text":117},{"id":134,"depth":250,"text":135},{"id":149,"depth":250,"text":150},{"id":163,"depth":250,"text":164},{"id":240,"depth":250,"text":241},"How to report a security issue in Katami, what we promise in return, and our commitment not to pursue researchers acting in good faith.","md",{},true,"\u002Flegal\u002Fdisclosure",{"title":7,"description":257},"legal\u002Fdisclosure","2026-09-24","lbn5W-MdVLxCdeEUpoY5PAhsKex55jLQQrs2nXJ4rhc",[267,268,271,274,277,280,283,286],{"title":7,"path":261},{"title":269,"path":270},"End-User License Agreement","\u002Flegal\u002Feula",{"title":272,"path":273},"How Your License Works","\u002Flegal\u002Flicense",{"title":275,"path":276},"Privacy Policy","\u002Flegal\u002Fprivacy",{"title":278,"path":279},"Refund Policy","\u002Flegal\u002Frefunds",{"title":281,"path":282},"Security","\u002Flegal\u002Fsecurity",{"title":284,"path":285},"Subprocessors","\u002Flegal\u002Fsubprocessors",{"title":287,"path":288},"Terms of Service","\u002Flegal\u002Fterms",1790804971680]