Security
We hold this site to the same security standard we hold client projects to. Here's what that means in practice, and how to report a problem.
What we do
- HTTPS enforced site-wide with HSTS.
- A strict Content-Security-Policy with per-request nonces for inline scripts.
- Server-side validation on every form submission — client-side checks are a convenience, not the security boundary.
- Rate limiting on public API routes to reduce abuse and spam.
- Dependencies monitored for known vulnerabilities and updated on a regular cadence.
- No secrets or API keys are ever exposed to the browser bundle.
Responsible disclosure
If you believe you've found a security vulnerability on this site or in one of our products, please report it to kahani.inc@gmail.com with enough detail to reproduce the issue. We ask that you:
- • Give us a reasonable amount of time to investigate and fix an issue before public disclosure.
- • Avoid accessing, modifying, or deleting data that isn't yours.
- • Avoid degrading service availability (no automated scanning that could cause a denial of service).
We aim to acknowledge reports within two business days.