Security
What Toolproof stores, who else processes it, and how to report a vulnerability.
Reporting a vulnerability
Email hello@kynth.studio. Include the URL, what you did, and what you saw. There is no bounty and no NDA to sign. We will confirm receipt, and we will tell you what we changed.
The same address, with a machine-readable expiry, is published at /.well-known/security.txt under RFC 9116.
Accounts
Toolproof has no user accounts. There is nothing to sign in to, no password to reset and no session to steal — the site is a published dataset and a set of static pages, and a build gate fails the deploy if an authentication route ever appears while this page still says otherwise.
What is stored
- An email address, only if you type one into the subscribe form, and only after you confirm it by clicking a link.
- Anonymous page analytics with the IP address truncated before it is stored.
Who else processes data
Also true
- Everything on this site is generated from public sources and rendered as static pages; there is no user-generated content that another visitor can see.
Toolproof is built and run by Kynth Studios. The declarations on this page are part of this product's own configuration and are re-checked at every deploy against the repository they describe: a product that claims to have no accounts and ships an authentication route fails the build, and so does one that takes payment without naming its payment processor here.
