Security

How we protect your data

• Everything is served over HTTPS, with strict security headers (including a Content Security Policy).
• Passwordless sign-in: 6-digit codes are stored hashed, expire in 10 minutes, and lock after repeated wrong guesses. Code requests and checks are rate-limited by address and IP.
• Every page and action checks your workspace membership and role on the server, on every request.
• Public project links use long random ids, are off by default, and can be turned off at any time.
• AI use is capped per person and across the service each day.
• Dependencies are checked for known vulnerabilities on every change.

Report a vulnerability

If you think you've found a security problem, email hello@kanso.com.au with the details and steps to reproduce it. We'll acknowledge it within 3 business days and keep you updated while we fix it.

Please:

• test only against your own account and data;
• don't access, change or delete other people's data, or degrade the service (no denial-of-service or spam testing);
• give us reasonable time to fix the issue before telling anyone else.

If you act in good faith and follow these guidelines, we won't pursue legal action against you for your research.