Security

Email security@kemble.io. We acknowledge every report within two working days. Please give us a reasonable window to fix an issue before disclosing it, and we will credit you unless you would rather we did not.

Say what you found, where, and how to reproduce it. A request and its response, or a short recording, saves a day of back-and-forth.

We will not take action against research that keeps to these rules, and we will treat a report made in good faith as help.

• Test only against accounts, workspaces and communities you own or have permission to test.
• Do not read, change or delete other people’s data. If you reach some by accident, stop, keep none of it, and tell us.
• Do not degrade the service for others: no denial-of-service, no flooding, no spam.
• No social engineering of people, and no physical tests.

The same contact is published for tools at kemble.io/.well-known/security.txt, as the internet standard for it (RFC 9116) describes.

How Kemble is built to keep your data safe is in the trust centre