Responsible disclosure
Send security reports to security@konduit.gg with scope, impact, and reproduction steps.
Security
Responsible disclosure for Konduit.
If you believe you have found a security issue in Konduit, send enough detail for the team to reproduce and assess it safely.
Disclosure intake
Send reports to security@konduit.gg. Please include only the information needed to validate the issue.
What to include
- Email security@konduit.gg with a clear summary, affected surface, impact, and reproduction steps.
- Avoid accessing data that is not yours, disrupting service, or sharing details publicly before coordination.
- We will review the report, ask for clarification when needed, and coordinate remediation before public disclosure.
Konduit keeps TLS validation enabled. Reports about transport, authentication, or credential handling are welcome through the same intake.
Encrypted on your computer
Platform tokens and account keys are encrypted with your operating system's secure storage: Keychain on macOS, DPAPI on Windows.
Scanned before it ships
Every change passes automated secret scanning and security rules, and every installer is scanned for leaked credentials before release.
No ad trackers
konduit.gg uses cookieless Vercel Web Analytics, and Sentry for error reports with masked session replays. The desktop app's crash reports can be turned off in Settings → Privacy.
Encrypted connections
Konduit talks to the platforms and to its own servers over HTTPS with certificate checks always on. Reports about certificate handling, redirects, or downgrade risk are welcome.
Credentials stay on your computer, encrypted
Platform tokens and account keys are stored with your operating system's secure storage through Electron's safeStorage: Keychain on macOS, DPAPI on Windows.
Platform sign-ins
Konduit connects through each platform's own sign-in where the platform offers one, and asks only for the permissions it uses. Please don't put access tokens in a report unless we ask for them.
Crash reports
The desktop app sends scrubbed crash and error reports to Sentry, as the privacy policy describes, so problems get fixed. Turn this off in Settings → Privacy.