Please report security vulnerabilities privately. Do not open a public issue for a suspected vulnerability.
Use GitHub's private vulnerability reporting on this repository:
- Go to the Security tab of firelock-ai/kin.
- Click Report a vulnerability to open a private security advisory.
- Include a description, affected versions, reproduction steps, and the impact you observed.
There is no paid bug-bounty program at this time.
| Stage | Target |
|---|---|
| Acknowledgement | 48 hours of receipt |
| Initial assessment | 5 business days |
| Fix or mitigation | 90 days (critical), 180 days (high/medium) |
| Coordinated disclosure | After fix ships; we contact the reporter before going public |
We will keep you informed as we investigate. If 90 days pass without a fix, we will discuss an extension or limited disclosure with you.
Kin is pre-1.0 and published as 0.x releases (alpha-grade: APIs and formats
may change between minor versions). Only the most recent 0.x release receives
security fixes; older tags are not patched. Fixes are shipped in a new 0.x
release rather than backported.
| Version | Supported |
|---|---|
Latest 0.x release |
✅ |
Older 0.x tags |
❌ |
When a 1.0 line is published, this table will be updated with a concrete support window.
This policy covers the kin repository: the CLI, daemon, MCP server,
projections, and the bundled crates and packages under crates/ and
packages/. Other Kin ecosystem repositories (for example kin-db,
kin-vfs, kinlab) carry their own security policies; report issues
against the repository where the affected code lives.
kin-vfs intercepts libc calls at runtime. Only install and use it from
the official signed release binaries. Verify the installer checksum
before running kin setup.