Security

Reporting a vulnerability

Email security@kizmo.io with the details and steps to reproduce. We acknowledge reports within two business days and won't take legal action against good-faith research that avoids privacy violations and service disruption.

How we protect accounts

• Passwords are hashed with a memory-hard algorithm; we never see them.
• Sessions use secure, HTTP-only cookies scoped to kizmo.io, with origin checks on every state-changing request.
• Sign-in, sign-up and password resets are rate limited.
• Staff access to the admin console is limited to named accounts, and every moderation action is written to an audit log.

How we protect people who scan

• Every destination is screened when it's saved: raw IP addresses, hidden credentials and look-alike brand domains are rejected.
• Codes reported as dangerous can be disabled after review; they then show a warning instead of redirecting.
• Redirect pages carry a strict Content Security Policy and no third-party scripts.

The safety checker

The checker follows redirects by requesting headers only. Every connection goes through a DNS check that refuses private, loopback and link-local addresses at connection time, uses only ports 80 and 443, and never downloads page bodies.