Last updated: 6 November 2026
Report a vulnerability
Write to the address in our security.txt, with what you found and how to reproduce it. Test only against an account of your own, and never against another customer's data or their visitors. A report is answered before any other message.
How soon we fix it
Each vulnerability is rated by what it could do to customers' data and to the service, and fixed in production within these times of being confirmed, whether you reported it or our own checks found it. Our code and every dependency are audited automatically each week.
| Severity | Fixed within |
|---|---|
| Critical | 7 days |
| High | 14 days |
| Medium and low | 30 days |
What is ours to secure, and what is yours
| Korzen | You |
|---|---|
| The engine that decides, and the data it keeps | Keeping your API key secret, on your server only |
| Encrypted backups, and TLS on every connection | Choosing the action for each class, starting in monitor mode |
| Availability, shown on our status page | Keeping the SDK up to date |
| Failing open: an error or a timeout lets your visitor through | What your own sign-up or checkout does with a bot: a block, a challenge, an email check |