Security
Your security is important to us. This page explains how to report vulnerabilities and what we do to keep VeryKit safe.
Reporting Vulnerabilities
If you discover a security vulnerability in VeryKit, please report it responsibly:
- Open a private security advisory on our GitHub repository
- Do not disclose the vulnerability publicly until a fix is available
- Include a detailed description of the issue and potential impact
- We will acknowledge your report within 48 hours
Security Design
VeryKit is designed with security in mind:
- Client-side only: All computations happen in your browser. No data is ever sent to a server.
- No data collection: We do not collect, store, or transmit any user data.
- No tracking: No analytics, cookies, or tracking scripts.
- Web Crypto API: Cryptographic operations use the browser's built-in secure APIs.
- Open source: Our code is publicly auditable on GitHub.
Scope
The following are considered in scope for security reports:
- Vulnerabilities in the web application code
- Issues with data handling or processing logic
- Cross-site scripting (XSS) vulnerabilities
- Any issue that could compromise user privacy