Please report suspected Kin security vulnerabilities privately. Prefer GitHub's Report a vulnerability form when it is available. If the form is unavailable, email kin-support@intriguingideas.com with the subject "Kin security report".

Do not put exploitable details, proof-of-concept code, or sensitive information in public issues, pull requests, discussions, or comments. Please coordinate disclosure with the maintainer so the issue can be investigated and affected users protected.

Include a short description, potential impact, affected app version/build or commit, iOS version, and minimal steps to reproduce using fictional data. Sanitized logs or screenshots may help. Do not send passwords, tokens, signing keys, real children's information, Contacts exports, or personal notebook data. If sensitive material seems necessary, first ask how to proceed without sending it.

Test only on devices, accounts, and data you own or have explicit permission to use. Use a disposable test notebook with synthetic names, dates, notes, and images. Keep testing non-destructive: do not access other people's data, disrupt services, attempt social engineering, or run automated abuse against support or reporting systems. Stop if testing unexpectedly exposes personal data and report the issue privately without copying or sharing that data.

Reports about the current App Store app and development builds are welcome. Identify the exact app version/build or commit tested because the public repository may differ from an installed build. Older development snapshots are not maintained separately, and fixes may require moving to a newer build.

Kin is maintained by an independent developer. Reports are reviewed as capacity allows; there is no guaranteed response or fix deadline and no bug bounty program. This policy does not grant permission to test third-party services or provide a legal safe-harbor commitment.