Vulnerability disclosure policy

If you have found a security problem in KiviDB, please tell us. This page says how, what is in scope, and what you can expect.

How to report

Email security@kividb.io. Include:

• what the problem is and what an attacker could do with it;
• the steps to reproduce it, and the address, version or account involved;
• how you would like to be credited, if at all.

Please do not report security problems in public: not in the community forum, not in a GitHub issue.

Scope

In scope:

• the website and console at kividb.io, the API at api.kividb.io, and the MCP server at mcp.kividb.io;
• databases you created yourself in KiviDB Cloud, including their management agent;
• the KiviDB server, the Kubernetes operator, the Terraform provider and the MCP server package.

Out of scope:

• other customers' databases and accounts;
• services run by other companies (payment, sign-in, support, hosting providers); report those to them;
• denial of service, volumetric attacks, spam and social engineering of KiviDB staff;
• findings from automated scanners with no demonstrated impact, and missing best-practice headers already listed as not in place on this site.

Rules

• Test only against accounts and databases you own.
• Do not read, change or delete data that is not yours. If you reach someone else's data, stop and report it.
• Do not degrade the service for others.
• Give KiviDB reasonable time to fix a problem before you disclose it. We ask for 90 days.

What KiviDB commits to

• To acknowledge your report within 3 business days.
• To tell you whether we accept it, and to keep you informed until it is fixed.
• To credit you when the fix is announced, if you want.
• Not to take legal action against you, or ask others to, for research carried out in good faith under these rules.

KiviDB does not run a bug bounty and does not pay for reports.

Known gaps

The overview lists controls that are not in place yet. You do not need to report those.