Security

What to report

A way to reach data that should not be reachable, another organisation's above all, or to act beyond your role.

Anything that changes what a page or a record says.

A flaw in how the pages are delivered.

A dependency you believe is exploitable here.

How to report

Include what you did, what you observed and the steps to reproduce the issue. Reproduction steps are more useful than a severity rating. There is no bug bounty or NDA.

Each report is read and answered by a person and acknowledged within 5 working days. This acknowledgement is not a fix deadline. Fix timelines depend on the issue and on whether SafeMode Space controls the affected component. When a reported issue is fixed, SafeMode Space states what was fixed and when.

The reporter keeps the rights to a vulnerability report.

Acknowledgments

No security issues have been publicly acknowledged yet. Researchers may request public credit or remain anonymous. A fix can be recorded without attribution.

Research in good faith

Kartia IKE will not take legal action against research that keeps to this page: you test only accounts you own or are allowed to use, you stop and report as soon as you reach data that is not yours, you do not keep or share it, and you do not degrade the service for others.

Out of bounds: denial of service, social engineering of staff or customers, physical attacks, and anything aimed at a customer's data or systems.

How the platform is built

The web session rides in an HttpOnly cookie, SameSite=Strict, and every write it authenticates carries a header no other site can set. Every page carries a content security policy with a nonce of its own. Passwords are stored as scrypt hashes, a second factor can be required for a whole organisation, and a session ends at sign-out, deactivation or a change of role.

One guard holds every API route to the least of five roles that may call it, and each write route is proved by a test against another organisation and against a read-only user. Every write and sign-in lands in an append-only audit trail, chained by hash, whose head can be timestamped daily by an outside authority.