Security
Transparency is core to Kairon. Security measures, audit findings, and the roadmap are all published here.
Kairon uses magic-link email authentication via Supabase. Each login requires access to your email inbox, which provides a form of implicit email-based verification. Full TOTP two-factor authentication (authenticator app) is on the roadmap and will be offered as an opt-in security upgrade.
• Do not access or modify other users' data
• Disclose privately first — allow 90 days for remediation
• First reporter of a unique vulnerability receives the reward
on request
We commit to acknowledging your report within 48 hours, providing a remediation timeline within 7 days, and crediting reporters in our changelog once fixes are deployed.
SEC-2026-003HIGHRESOLVED2026-05-16AdminPanel Defense-in-Depth Hardening
Sweep of every /api/admin/* route surfaced four endpoints with NO authentication: notifications (GET/POST/DELETE/PATCH), posts (DELETE/PATCH), auto-tag (GET/POST), kaironos (GET/POST). All four could have been called anonymously to read or mutate site-wide state. Patched in commit cab96bf along with a triple-layer admin gate.
SEC-2026-002INFORESOLVED2026-05-10Session Authentication Improvement
Server-side Pro/Admin detection used to rely on a legacy kairon_email cookie. Migrated entirely to Supabase sb-* cookies + getServerAuth() across every page, API route, and middleware. No custom identity cookies.
SEC-2026-001INFORESOLVED2026-04-25Initial Security Audit
Comprehensive review of authentication flows, RLS policies, and API endpoints. All critical paths verified secure.