Security

1. Who you are dealing with

KinetixSEO is built and run by one person. When you report a security problem it lands in my inbox and I read it myself. That also means I cannot match the response times of a big security team. What I can promise is written below and I stick to it.

2. How to report a problem

Email infra@aevonix.nl. The address is on aevonix.nl because Aevonix B.V. is the company behind KinetixSEO. It is the same address listed in the site's security.txt. You can write in English or Dutch.

• Report it to me first and privately. Please do not post it, tweet it or tell others until it is fixed.
• Give me the details. The URL or endpoint, what you did step by step and what happened. A short proof of concept helps a lot.
• Tell me the impact. What could an attacker actually do with it? "Header X is missing" is not a finding on its own. "I can read another customer's report" is.
• Use your own account and your own data. If you reach someone else's data by accident, stop there, do not keep or share it and mention it in your report.

3. What I commit to

• I confirm I received your report within 5 working days.
• I tell you if I can reproduce it and what I plan to do about it.
• Serious problems get worked on first and straight away. I aim to fix those within 30 days. If it takes longer I tell you why.
• I let you know when the fix is live, so you can check it yourself.
• I do not share your name or your report with anyone without asking you first.

4. No paid bug bounty

KinetixSEO is a one-person company and I do not run a paid bug bounty. I do not pay for reports, also not for valid ones. What I do offer is public credit: once the problem is fixed I add your name (and a link if you like) to the acknowledgements at the bottom of this page. Only if you want that, of course.

If your first message asks for payment before you tell me what you found, this page is my answer. I do not negotiate over a report. Send me the details and I fix the problem. That is the whole deal.

5. In scope

• The KinetixSEO web app at kinetixseo.com, including accounts, billing and reports.
• The KinetixSEO API.
• The MCP server at kinetixseo.com, including its OAuth flow.

What I most want to hear about: getting into another user's account or data, bypassing login or permissions, injection (SQL, or script that runs in someone else's browser), code running on my server and anything that leaks secrets or payment details. KinetixSEO fetches the URLs you give it: that is what the product does. A way to make it reach my own internal network or services is a real finding though.

6. Out of scope

I do not treat these as vulnerabilities on their own. If you can show a real attack that builds on one of them, that attack is in scope.

• Missing or "weak" security headers, without a working exploit.
• SPF, DKIM or DMARC reports and other email spoofing settings.
• Clickjacking on pages that have no action to click, like static content pages.
• The XSRF-TOKEN cookie being readable by JavaScript. That is by design: the app reads it and sends it back as a CSRF header.
• What robots.txt or the sitemap lists.
• Software names, version numbers or other fingerprints, without a vulnerability you can show.
• The Content Security Policy's form-action allowing http://localhost:* and the other loopback addresses. MCP clients that run on your own computer receive their OAuth redirect on a random local port, as RFC 8252 describes. Without it they cannot connect.
• Rate limiting, brute force, denial of service or load testing.
• Social engineering, phishing or physical attacks.
• Output from an automated scanner, without a real finding you checked yourself.
• Services I use but do not run, such as the payment provider. Please report those to that company.

7. Please do not

• Run active scanners that submit forms. Many forms on KinetixSEO start paid work: an audit, an AI check or a report. Every automated submission costs me real money and some send emails to real people.
• Use KinetixSEO to send traffic at sites you do not own.
• Load-test or try to slow down the production site.
• Access, change or delete data that is not yours.

8. Safe harbour

If you act in good faith and follow this page, I see your research as authorized. I will not take legal action against you or report you to the police for it. Not sure if a test is OK? Ask me first at the same address.

9. Acknowledgements

Nobody is listed here yet. Find a real problem, report it the way this page describes and you can be the first.