Security & disclosure

Website operator

Kagi, Banstraat 14-2, Amsterdam, the Netherlands. The KvK number is pending; no registration status is implied. Release review remains open.

Report a website security concern

Email info@symmaxa.com with the subject “Kagi website security report”. Include the affected page, when you observed it, a concise explanation and minimal, non-sensitive reproduction steps. Redact personal data, credentials and message content. Ask for a secure exchange method before sending sensitive evidence; a dedicated encrypted reporting channel is not yet confirmed.

Keep reports safe

Do not access other people’s data, use leaked credentials, disrupt services, perform denial-of-service tests or run automated scanning without prior authorisation. Stop if personal or confidential information appears and report the issue without copying it. Please allow the operator to investigate before public disclosure. This information is not a safe-harbour promise, authorisation to test, a bounty offer or a guaranteed response deadline.

Website safeguards and limits

The adviser is intentionally unavailable; rejected questions are not forwarded to the AI service. No quota service has been connected. Its endpoint validates same-origin JSON requests and bounds request size and message lengths. Secrets stay on the server. AI-rendered content is restricted to approved links without arbitrary images. Email drafts go to the existing contact and are sent only through your email application.

Security response headers are configured for review. Production script protection uses per-response permissions for application scripts; inline styles remain allowed for the existing interface. Actual hosting enforcement, diagnostics and provider contracts still require verification. This website is not represented as independently audited, certified, GDPR-certified or fully secure.

Active incidents and human help

If you are dealing with an active incident, involve your organisation’s security lead or incident-response provider; use the appropriate national CERT or emergency authority when needed. Do not paste passwords, evidence containing personal information or confidential incident details into Ask Kagi. For course or advisory enquiries, use the contact page and send a reviewed email.