We welcome reports from security researchers. To report a vulnerability, email security@kachy.app. This page explains what you may test, the rules to follow, and how we respond.
1. In scope
You may test the following systems as long as you follow the rules on this page.
- The website and web app at kachy.app are in scope.
- The API at api.kachy.app is in scope, including the MCP server at api.kachy.app/mcp and the sign-in flow that AI clients use to connect to it.
- The escrow and verification contracts that kachy operates are in scope. They currently run on test networks at the addresses below, and we update this list when we deploy new versions.
- On Base Sepolia (chain ID 84532), the escrow contract is 0x16962E2F8a48a39901Dec635b12C7C4eF485582D and the verification contract is 0xf393AC5D41b8157c3Ac5b88FEc4c79765d6c66dd.
- On GIWA Sepolia (chain ID 91342), the escrow contract is 0xfE258b05b94995847b7Ebd4D3F4048595a448Dbe and the verification contract is 0x11f245116666C1263A2C0552e65126a9997829DA.
- These contracts are upgradeable proxies, and the implementation contracts behind them are in scope as well.
2. Out of scope
The following systems are out of scope. Please report issues in them to their owners directly.
- The marketplaces and stores that kachy buys from are out of scope, and so are the accounts kachy uses on them.
- Third-party providers that kachy relies on are out of scope. This includes payment, wallet, hosting, email, and shipment tracking services, and the blockchains our contracts run on.
3. Rules for testing
These rules protect buyers and partners. Please follow all of them.
- Do not test against real buyers' orders, accounts, or funds.
- Use a test account that kachy provides for anything that creates a request, an offer, or an order. An order can lead to a real purchase, so please ask for a test account at security@kachy.app before you start.
- Do not create, sign in to, or misuse accounts on the marketplaces that kachy buys from. Do not try to make kachy do any of this for you either.
- Do not access, change, or delete data that belongs to someone else. If you reach data that is not yours, stop there. Describe what you saw in your report instead of attaching it.
- Do not run denial of service attacks, load tests, or automated scans that send a large number of requests.
- Do not try social engineering or phishing against buyers, partners, or kachy staff.
- Keep the details private until we have fixed the issue, or until we have agreed on a date with you.
4. Safe harbor
If you act in good faith and follow this policy, we will treat your research as authorized. We will not take legal action against you for it, and we will not support anyone else who does.
This protection cannot cover the marketplaces and third-party providers listed as out of scope, because kachy cannot authorize testing of systems it does not own.
If you are unsure whether something you plan to do is allowed, ask us first at security@kachy.app.
5. How to report
Email security@kachy.app in English or Korean. Please include the following in your report.
- Tell us the affected URL, API endpoint, MCP tool, or contract address.
- Give us step-by-step instructions that let us reproduce the issue.
- Explain what an attacker could do with it, as far as you know.
- If you used a test account, an order reference, or a transaction hash while testing, include it.
- If you would like public credit, tell us the name or handle you want us to use.
6. What happens after you report
We will acknowledge your report within 3 business days. After that, we will tell you whether we could reproduce the issue, what we plan to do about it, and when the fix is live.
Issues that could affect buyers' funds, orders, or accounts come first.
We credit reporters publicly only when they ask us to.