Security
Reporting a vulnerability.
If you have found a security problem in Kovan, we want to hear about it before anyone else does.
How to report
Email security@kovan.dev. Please do not open a public issue for a security problem.
A useful report has:
- what is affected: the desktop app (with its version and platform), the server, or this site;
- the steps to reproduce it, or a proof of concept;
- what an attacker could read or do;
- how to reach you, if you want updates.
Test only against accounts and workspaces that are yours. Do not read, change or delete other people’s data, and do not degrade the service for others.
What we do with a report
- We confirm that we received it and reproduce the problem.
- We tell you what we found and what we plan to do, and keep you posted until it is fixed.
- We fix it, release the fix, and note it in the changelog.
- We credit you if you would like that, and keep your report private if you would not.
What is encrypted
- In transit. The app and this site talk to the server over TLS.
- Session transcripts. Secrets are redacted by pattern first; the transcript is then encrypted by the server before it is stored, and deleted after the retention period (90 days unless your organization changes it).
- GitHub tokens are encrypted by the server before they are stored.
- Sign-in sessions are stored as hashes on the server. The desktop app keeps its token in the operating system’s encrypted store; this site keeps it only for the life of the tab.
- Card details go to the payment processor’s hosted page and never reach Kovan.
The server holds the encryption keys, so this is encryption at rest, not end-to-end encryption. Your source code is not stored on the server at all: it stays in your checkouts and travels through your own Git remote. More detail is in Security and privacy.