Security

Last updated: 2026-09-23. Effective: 2026-09-23.

This page explains how to report a security vulnerability in Kodanote, what we ask of you while you research, and what you can expect from us. It is published at https://www.kodanote.com/legal/security/ by Solidmatics Inc., a Delaware corporation (“Solidmatics”, “we”, “us”, “our”), which operates Kodanote (the “Service”). Terms used here with capital letters, such as Organization, have the meanings given in our Terms of Use at https://www.kodanote.com/legal/terms-of-use/.

If you think you have found a security problem, we want to hear about it. Reports from people outside the company help us protect our customers, and we read every report we receive.

1. How to Report a Vulnerability

Email your report to [email protected]. Please use a subject line that starts with “Security report” so that it reaches the right people quickly.

Please do not report vulnerabilities through public channels, social media, app store reviews or general support requests. If you are not sure whether something is a security issue, send it anyway.

If you think your own account, an Organization you belong to or a Connected Platform has been compromised, follow Section 5.3 (Account Security) of the Terms of Use and contact [email protected].

2. What to Include

A good report lets us reproduce the problem without further questions. Please include:

  • a short summary of the problem and its likely impact;
  • your estimate of its severity, with a sentence on why (for example, whether it lets someone read or change another Organization’s data, take over an account, or only affects the reporter’s own session);
  • step-by-step instructions to reproduce it, or a proof of concept;
  • the affected URL, API endpoint or screen, and for the mobile apps, the app version;
  • the environment you used, such as the operating system and version, the browser and version, or the device model; and
  • how you would like to be credited, if at all (see Section 8 (Recognition)).

3. Sensitive Material

We do not currently publish an encryption key for security reports. If your report would include access tokens, session cookies, credentials, personal information or sensitive logs, please tell us first, without sending that material, and we will agree with you a secure way to receive it. Where you can, redact or truncate secrets and personal information in screenshots and logs.

4. Scope

4.1 In scope

  • www.kodanote.com (our public website)
  • app.kodanote.com (the Kodanote web dashboard)
  • api.kodanote.com (the Kodanote API)
  • the Kodanote iOS app and the Kodanote Android app, as distributed through the Apple App Store and Google Play
  • connect.solidmatics.com and connect-ui.solidmatics.com (the connection service we operate to link Connected Platforms to Kodanote)

If you find an issue in another system that appears to be operated by Solidmatics and to handle Kodanote data, but is not listed above, please contact us before testing it further.

4.2 Out of scope

The following are outside this policy. We may not respond to reports about them, and Section 6 (Safe Harbor) does not cover testing them:

  • third-party services that we use to provide the Service, or that customers connect to it (for example social media and other Connected Platforms, authentication and hosting providers, and app stores). Please report issues in those services to their owners under their own disclosure programs. If the issue is in how we have set up or configured a service we use (for example our own storage bucket or our self-hosted connection service), report it to us under this policy;
  • social engineering of our staff, contractors or customers, including phishing;
  • physical attacks against our offices, staff, equipment or data centers;
  • denial of service attacks and any volumetric or load testing;
  • spam, including sending unsolicited messages through the Service or its forms;
  • findings that require a rooted or jailbroken device, or an outdated or unsupported browser or operating system; and
  • missing best-practice security headers, cookie flags or other configuration settings, unless you can show a concrete security impact.

5. Rules of Engagement

When you research the Service, please:

  • test only with accounts and Organizations that you created and control;
  • not access, modify, delete or keep data that belongs to other users or Organizations. If you come across such data, stop, do not use or share it, and report it to us straight away;
  • not publish, schedule or send content to any Connected Platform account that you do not own or have permission to use;
  • not run high-volume automated scanning, and keep any automated testing at a low rate that does not degrade the Service for others;
  • do only what is needed to confirm the vulnerability, and not use it to go further into our systems, move to other systems or keep access;
  • keep the details confidential until we have fixed the problem, and give us a reasonable amount of time to fix it before any public disclosure. We will work with you on timing and, if you plan to publish, we ask that you share a draft with us first; and
  • comply with applicable law.

6. Safe Harbor

If you make a good-faith effort to follow this policy, we will treat your research as authorized by us. For that research, we will not treat it as a breach of Section 13.1 (Prohibited Conduct) or Section 14.2 (License to Use the Service) of the Terms of Use, we will not bring a claim against you under the anti-circumvention provisions of 17 U.S.C. 1201 or under computer-misuse laws such as the Computer Fraud and Abuse Act, we will not otherwise bring legal action against you, and we will not report you to law enforcement. If a third party brings legal action against you for research that followed this policy, we will make it known that your research was authorized by us.

This safe harbor covers only systems listed as in scope in Section 4.1 (In scope). We cannot authorize testing of systems that belong to others, including the third-party services described in Section 4.2 (Out of scope), and this policy does not bind them. Good faith does not extend to research that causes harm to our customers or the Service, or that extorts, threatens or demands payment from us. If you are unsure whether something you want to do fits this policy, ask us at [email protected] before you do it.

7. What Happens After You Report

We aim to acknowledge your report promptly. We will then review it, let you know whether we can reproduce it, and keep you informed about our progress toward a fix. We may ask you for more detail. When the issue is resolved, we will tell you, and we are happy to coordinate the timing of any public disclosure with you.

We handle the personal information in your report, including your contact details, as described in Section 2.1 (Information you provide to us) of our Privacy Policy at https://www.kodanote.com/legal/privacy-policy/.

8. Recognition

We do not currently run a paid bug bounty program, and we do not offer money, swag or other rewards for reports. If you would like credit for a valid report, tell us the name or handle to use, and we will use it wherever we publicly acknowledge the issue or its fix. If you prefer to stay anonymous, we will respect that.

9. Our Security Practices

For a description of the measures we use to protect personal information, see Section 7 (Security) of our Privacy Policy at https://www.kodanote.com/legal/privacy-policy/.

10. Changes to This Page

We may update this page from time to time. The “Last updated” date at the top shows when it last changed. Research carried out while an earlier version was in effect is covered by that version.