KeyStone holds CVs and other personal documents, so we take security seriously and want to hear about problems. This page explains how to report a vulnerability and what we do to protect your data.
Report a vulnerability
Email [email protected] with the subject "Security". Please include what you found, the steps to reproduce it, and the address or page it affects. Plain text is fine. Please do not include other people's personal data in your report.
- We aim to acknowledge your report within 3 working days and to keep you updated until it is resolved.
- If you would like credit for the finding, tell us how you want to be named. If you would rather stay anonymous, we will respect that.
- This contact is also published in machine-readable form at /.well-known/security.txt.
Scope
In scope: keystone.extrafemi.com and the functions it calls under /api.
Out of scope: attacks on the services we depend on (report those to the provider, listed on the subprocessors page), social engineering of our team or users, physical attacks, and anything that needs denial of service or high-volume automated scanning to demonstrate.
Ground rules
- Only test against your own account. Do not access, change or delete anyone else's data.
- Stop and tell us as soon as you reach another person's data.
- Give us a reasonable time to fix the problem before you share it publicly.
If you follow these rules and act in good faith, we will not take legal action against you for your research.
No bug bounty
We do not run a paid bug bounty programme. We can offer thanks and public credit, not payment.
How KeyStone protects your data
- Encrypted in transit. The site is served over HTTPS only, with HTTP Strict Transport Security.
- Browser protections. A Content Security Policy, no framing of the site, no content-type sniffing, a strict referrer policy, and camera, microphone and location switched off.
- No password to steal. Sign-in is Google, an emailed link or a one-time code. KeyStone never stores a password.
- Your data is separate from everyone else's. Database rules allow an account to read and write only its own documents, and CV text can only be written by the server, never directly from a browser.
- Secrets stay on the server. API keys for email and AI providers exist only in the server environment, never in the website's code. If you add your own AI key in Settings, it is kept only in your browser.
- Abuse limits. Requests are rate-limited per account and per network address.
- Uploaded files are not kept. CVs and job description files are read for their text and the original file is discarded.
- You can delete everything. Settings has a self-serve option that deletes your account and all its data.
What we do not have
KeyStone does not hold a security certification such as SOC 2 or ISO 27001, and we have not published an independent penetration test. We would rather say so plainly than imply otherwise.