Skip to content

Security: firelock-ai/kin

SECURITY.md

Security Policy

Reporting a Vulnerability

Please report security vulnerabilities privately. Do not open a public issue for a suspected vulnerability.

Use GitHub's private vulnerability reporting on this repository:

  1. Go to the Security tab of firelock-ai/kin.
  2. Click Report a vulnerability to open a private security advisory.
  3. Include a description, affected versions, reproduction steps, and the impact you observed.

There is no paid bug-bounty program at this time.

Response SLA

Stage Target
Acknowledgement 48 hours of receipt
Initial assessment 5 business days
Fix or mitigation 90 days (critical), 180 days (high/medium)
Coordinated disclosure After fix ships; we contact the reporter before going public

We will keep you informed as we investigate. If 90 days pass without a fix, we will discuss an extension or limited disclosure with you.

Supported Versions

Kin is pre-1.0 and published as 0.x releases (alpha-grade: APIs and formats may change between minor versions). Only the most recent 0.x release receives security fixes; older tags are not patched. Fixes are shipped in a new 0.x release rather than backported.

Version Supported
Latest 0.x release ✅
Older 0.x tags ❌

When a 1.0 line is published, this table will be updated with a concrete support window.

Scope

This policy covers the kin repository: the CLI, daemon, MCP server, projections, and the bundled crates and packages under crates/ and packages/. Other Kin ecosystem repositories (for example kin-db, kin-vfs, kinlab) carry their own security policies; report issues against the repository where the affected code lives.

High-Risk Features

kin-vfs LD_PRELOAD / DYLD_INSERT_LIBRARIES shim

kin-vfs intercepts libc calls at runtime. Only install and use it from the official signed release binaries. Verify the installer checksum before running kin setup.

There aren't any published security advisories