# Security

> How Kizmo protects accounts and data, how our QR safety checker is isolated from private networks, and how to report a vulnerability.

Canonical page: https://kizmo.io/security

## Reporting a vulnerability

Email [security@kizmo.io](mailto:security@kizmo.io) with the details and steps to reproduce. We acknowledge reports within two business days and won't take legal action against good-faith research that avoids privacy violations and service disruption.

## How we protect accounts

- Passwords are hashed with a memory-hard algorithm; we never see them.
- Sessions use secure, HTTP-only cookies scoped to kizmo.io, with origin checks on every state-changing request.
- Sign-in, sign-up and password resets are rate limited.
- Staff access to the admin console is limited to named accounts, and every moderation action is written to an audit log.

## How we protect people who scan

- Every destination is screened when it's saved: raw IP addresses, hidden credentials and look-alike brand domains are rejected.
- Codes reported as dangerous can be disabled after review; they then show a warning instead of redirecting.
- Redirect pages carry a strict Content Security Policy and no third-party scripts.

## The safety checker

The checker follows redirects by requesting headers only. Every connection goes through a DNS check that refuses private, loopback and link-local addresses at connection time, uses only ports 80 and 443, and never downloads page bodies.

---

Kizmo: QR codes you own. https://kizmo.io/