Ukity — Security & Responsible Disclosure
Version 1.0.0 · Effective 2026-07-11 · Last updated 2026-07-11
We take the security of your reflections and personal data seriously. This page
summarizes how we protect Ukity and how to report a vulnerability.
1. How we protect your data
- Encryption in transit: all traffic uses HTTPS/TLS.
- Credentials: passwords are stored only as strong hashes (BCrypt); sign-in
and session tokens are stored hashed.
- Access control: the API denies access by default and enforces
authentication and role/permission checks.
- Session safety: refresh tokens rotate and reuse is detected and revoked;
repeated failed logins temporarily lock an account.
- Abuse protection: sensitive endpoints (authentication, billing) are rate
limited.
- Backups: encrypted backups run on a schedule with a tested restore
process.
- Diagnostics: crash/error reporting is optional and off unless enabled.
No method of transmission or storage is completely secure, but we work to
protect your data using appropriate technical and organizational measures.
2. Reporting a vulnerability
If you believe you have found a security vulnerability, please email
security@zagru.com with:
- a description of the issue and its potential impact;
- steps to reproduce (proof-of-concept if possible);
- any relevant logs, URLs or screenshots.
Please report promptly and give us reasonable time to investigate and fix the
issue before any public disclosure.
3. Safe-harbour for good-faith research
If you act in good faith and follow this policy, we will not pursue or support
legal action against you for your research. Good-faith research means you:
- only access data that belongs to your own test account;
- do not access, modify or delete other users' data;
- do not degrade, disrupt or overload the Service;
- do not publicly disclose the issue until we have addressed it;
- comply with applicable law.
4. Out of scope
Findings that require physical access to a user's device, social engineering of
our staff or users, or attacks on third-party services (for example, the app
stores or hosting provider) are out of scope.
5. Our commitment
We will acknowledge your report, keep you informed of our progress, and, where
appropriate, credit you once the issue is resolved. We do not currently operate a
paid bug-bounty program.
6. Contact
Security: security@zagru.com · General: hello@ukity.com.