Security

Last updated October 16, 2026

Found a security problem in KaveLight or kavelight.com? Email security@kavelight.com. We read every report, acknowledge it within 5 business days, and work with you until it is fixed.

1. Report a vulnerability

• Email security@kavelight.com. If the details are sensitive, ask for a secure channel first and we will arrange one.
• Tell us what you found, where (the URL, the app version or the API), how to reproduce it, and what an attacker could do with it. Screenshots and proof-of-concept code help.
• The same contact is published in machine-readable form at /.well-known/security.txt.
• We acknowledge your report within 5 business days, keep you informed while we investigate and fix it, and are glad to thank you publicly once the fix has shipped, if you wish.

2. Scope

In scope: kavelight.com and its subdomains, the backend the site and the app talk to, the KaveLight Mac app and its update feed, and the KaveLight connector for Claude and ChatGPT.

Out of scope: the third-party services listed in section 5 (report those to the vendor); other users’ Community uploads (report infringing or harmful content to support@kavelight.com); findings from automated scanners with no demonstrated impact; missing best-practice headers or settings with no working exploit; issues that need physical access to someone’s Mac; social engineering of our staff or users; and denial of service.

3. Safe harbor

We will not pursue or support legal action against you, or report you to law enforcement, for security research that:

• follows this policy and is carried out in good faith;
• avoids privacy violations, data destruction and service disruption: access or change only data that belongs to you or to a test account you created, and stop and tell us as soon as you come across someone else’s personal data;
• does not use social engineering, phishing, physical attacks or denial of service;
• gives us a reasonable time to fix the problem before any public disclosure: 90 days from your report, less if the fix ships sooner, longer only by agreement.

If you are unsure whether something is covered, ask first at security@kavelight.com. If a third party takes legal action against you for research that followed this policy, we will make it known that you acted under it. This safe harbor covers our own systems only; it cannot authorize testing of the third-party services below.

4. What we do

• Sign-in is handled by Clerk; passwords are never stored by us.
• Payments are handled by Stripe; card details go straight to Stripe and never reach our servers.
• Everything between the app, the website and our servers travels over TLS.
• App updates are signed and notarized by Apple and delivered through a signed update feed.
• If we learn of a breach that affects your personal data, we will tell affected users by email as the law requires.

5. Status of the services we build on

• Clerk (sign-in): status.clerk.com
• Convex (backend): status.convex.dev
• Cloudflare (downloads and assets): cloudflarestatus.com
• Vercel (this website): vercel-status.com
• Stripe (payments): status.stripe.com

We do not run a status page of our own yet. If KaveLight cannot sign in or download, check these first, then email support@kavelight.com.