Security.

How to report a security vulnerability in Katsumii — and what you can expect from us.

1. Reporting a Vulnerability

Please report findings to security@katsumii.com and not publicly. We confirm receipt within 5 business days and follow up with an assessment.

Please give us 90 days to fix the issue before disclosing it publicly, and do not test against systems or data belonging to other users.

We do not pay bounties, but we are happy to credit you in the changelog if you would like.

In scope are the Katsumii desktop app and katsumii.com.

Out of scope are the systems of Lemon Squeezy and the connected brokers. Please report findings there directly to the respective provider.