Kanorio

Vulnerability Disclosure Policy

This Vulnerability Disclosure Policy sets out how security researchers can report potential security vulnerabilities in Kanorio and the guidelines for conducting good-faith security research.

Last updated: October 17, 2026

At Kanorio, Inc. ("Kanorio," "we," "us," or "our"), keeping our users' websites, customer data, and commerce operations secure is a core priority. We value the work of independent security researchers who help us maintain high security standards across our platform.

If you believe you have discovered a security vulnerability in Kanorio's services, we encourage you to report it to us in accordance with this Vulnerability Disclosure Policy ("Policy").

1. Purpose and Scope

This Policy applies to security research conducted on Kanorio-owned and operated web properties and services, including:

  • The Kanorio marketing website and documentation (kanorio.com).
  • The Kanorio web application, site editor, store dashboard, and API endpoints (app.kanorio.com).
  • Kanorio Agent access endpoints (OAuth 2.1, MCP, and REST API v1).
  • Public site rendering infrastructure (*.kanorio.com), strictly limited to test websites that you create and own yourself.

Customer websites, customer-owned domains, customer data, and third-party infrastructure providers (such as Cloudflare, Neon, Stripe, PAYUNi, and SHOPLINE Payments) are strictly out of scope for testing against real accounts or third-party systems.

2. Safe Harbor for Good-Faith Research

When you conduct security research in good faith and in full compliance with this Policy, we consider your research to be authorized:

  • We will not initiate civil legal action or refer your activity to law enforcement for accidental, good-faith violations of our Terms of Service that occur solely as part of compliant security research.
  • We will treat your activity as authorized under applicable anti-hacking and computer-access laws (such as the U.S. Computer Fraud and Abuse Act) to the extent permitted by Kanorio.
  • If legal action is initiated by a third party against you for activities that were conducted in strict compliance with this Policy, we will take steps to make it known that your actions were conducted pursuant to this Policy.

Safe Harbor applies only to claims within Kanorio's control and does not authorize you to access third-party systems, customer accounts, or data belonging to anyone other than yourself.

3. Rules of Engagement

Because Kanorio is a multi-tenant website building and commerce platform, you must follow these rules at all times during your research:

  • Test only against your own accounts and sites: To test tenant isolation, authorization boundaries, or Insecure Direct Object References (IDOR), register two separate free test accounts and test exclusively between your own test sites. Never attempt to access, modify, or delete data, contacts, orders, media assets, or settings belonging to any other Kanorio user.
  • Stop immediately if you encounter non-public data: If you inadvertently access data belonging to another user or internal Kanorio data, stop testing immediately, do not save, copy, or disclose the data, and report the issue to us right away.
  • No service degradation or automated flooding: Do not perform Denial of Service (DoS/DDoS) attacks, high-volume automated scanning, rate-limit exhaustion, bulk form submissions, bulk email sending, or excessive AI credit consumption.
  • No real payment instruments: When testing store or billing flows, never enter real credit card numbers or test against third-party payment processor systems.
  • No social engineering or physical testing: Do not conduct phishing, vishing, smishing, or social engineering against Kanorio employees, contractors, or customers.
  • Confidentiality and coordinated disclosure: Do not publicly disclose any suspected vulnerability before we have confirmed, remediated, and notified you that the issue is resolved.

4. In-Scope Vulnerability Categories

We are particularly interested in reports demonstrating verified, reproducible security impact in the following areas:

  • Cross-tenant isolation bypass: Unauthorized reading, modification, or deletion of another tenant's website content, customer contacts, form submissions, store orders, media assets, or encrypted third-party credentials (verified using two of your own test accounts).
  • Authentication and session vulnerabilities: Bypassing Magic Link, OAuth, Passkey, or Multi-Factor Authentication (MFA), or unauthorized session hijacking.
  • Privilege escalation: Escalating permissions from a lower website member role (such as Viewer or Member) to Owner or Admin, or gaining unauthorized access to internal administrative interfaces.
  • Server-side code execution and injection: Remote Code Execution (RCE), SQL Injection (SQLi), or Server-Side Request Forgery (SSRF) capable of accessing internal services or metadata.
  • Cross-Site Scripting (XSS): Stored or Reflected XSS that executes in the context of another user's dashboard session or across tenant origins (excluding Self-XSS).
  • Domain and subdomain takeover: Hijacking a verified custom domain or claiming a reserved Kanorio subdomain without authorization.
  • Checkout and payment integrity: Manipulating order totals, currency, or payment verification status within Kanorio's checkout state machine.

5. Out-of-Scope and Non-Qualifying Issues

The following issue types are outside the scope of this Policy and will generally not be accepted or investigated as security vulnerabilities:

  • Self-XSS or intended site-builder features: Scripts, HTML, or third-party embeds placed by a site owner (or authorized team member) on their own site, or payloads that require tricking a user into pasting code into their own browser or editor.
  • Unverified scanner output: Raw output from automated vulnerability scanners or AI tools without a working, reproducible Proof of Concept (PoC) demonstrating real-world impact.
  • Rate limiting, brute force, and volumetric abuse: Reports concerning missing rate limits, form flooding, email bombing, or passwordless login email enumeration without a demonstrable authentication bypass.
  • Theoretical header, TLS, or DNS configuration reports: Reports regarding missing non-critical HTTP security headers, permissive CORS without sensitive data exposure, CSP policy trade-offs for cached pages, or SPF/DKIM/DMARC record suggestions.
  • Information disclosure without security impact: Publicly accessible metadata (such as /.well-known/* endpoints, OpenAPI specs, or sitemap files), stack traces without sensitive secrets, or software version banners.
  • Clickjacking on pages that do not perform sensitive state-changing actions.
  • Recently disclosed third-party vulnerabilities (0-days) within 14 days of public disclosure where patches are already in progress.

If you want to report a website created on Kanorio for phishing, impersonation, copyright infringement, or other policy violations (rather than a technical software vulnerability), please use our Content Report Form or see our Content Guidelines. For general account or billing help, contact support@kanorio.com.

6. How to Submit a Report and Response Targets

Please send vulnerability reports by email to security@kanorio.com (also published at /.well-known/security.txt). To help our team triage and reproduce your finding quickly, please include:

  • The affected URL, API endpoint, or component.
  • A clear, step-by-step description to reproduce the issue (including HTTP requests/responses, screenshots, or a minimal Proof of Concept).
  • The identifiers or URLs of the test accounts and test sites you used.
  • Your assessment of the potential security impact.

We strive to meet the following best-effort response targets for valid, in-scope reports:

  • Initial acknowledgment: Within 3 business days of receipt.
  • Triage and severity assessment: Within 7 business days of acknowledgment.
  • Resolution updates: Periodic updates as remediation progresses and confirmation once the fix is deployed.

7. Program Evolution and Recognition

Kanorio currently operates a Vulnerability Disclosure Program (VDP) and does not offer a public, fixed-rate cash bug bounty program at this stage. Submissions are made on a voluntary basis.

We plan to launch a formal Bug Bounty Program in the future as our security operations expand. In the meantime, for exceptional, well-documented, first-reported vulnerabilities that demonstrate critical or high-severity impact (such as cross-tenant data access, authentication bypass, or remote code execution), Kanorio may, at its sole discretion, offer discretionary recognition, platform credits, or a discretionary reward.

Any discretionary recognition or reward is determined solely by Kanorio on a case-by-case basis, is not an entitlement or legal obligation, and requires full compliance with this Policy.