Security
Security at Keymint.
Found a vulnerability? Tell us privately and we'll work with you to fix it.
Include the affected endpoint or component, steps to reproduce, and the impact. Don't include live customer data or license keys. We acknowledge reports within 2 business days, and ask that you give us reasonable time to fix an issue before disclosing it publicly.
We won't pursue good-faith research that avoids privacy harm, data destruction and service disruption. We don't run a paid bug bounty.
In scope
- keymint.dev
- app.keymint.dev
- api.keymint.dev
- Official SDKs (github.com/keymint-dev/Keymint-*)
Out of scope
- Social engineering or phishing
- Denial of service or volumetric testing
- Spam or rate-limit findings without security impact
- Third-party services we use
How we protect licensing
Encrypted license keys
AES-256-GCM at rest, looked up by SHA-256 hash, never logged.
Signed offline files
Ed25519 JWTs; signing keys encrypted with AWS KMS.
Floating session proofs
HMAC-SHA256 heartbeats with a rotating single-use nonce.
Scoped API keys
admin, client and read-only scopes, bound to your organization.