Security
Last updated November 6, 2026
Korso, Inc. ("Korso", "we", "us") welcomes reports of security vulnerabilities in korsoai.com and the services behind it. This page explains how to report one and what you can expect from us in return.
1. How to report
Email dev@korsoai.com with the details. Please keep the issue private until we have fixed it, and do not report it in a public forum first.
2. What to include
- The page, address or part of Korso that is affected.
- What the vulnerability is and what an attacker could do with it.
- The steps to reproduce it, with any proof-of-concept code, requests or screenshots.
- How we can reach you, and whether you would like to be credited.
Do not send us other people's personal data. If your research exposed some, describe what you saw rather than copying it.
3. Safe harbour for good-faith research
If you research and report in good faith under this policy, we consider your research authorized, we will not take or support legal action against you for it, and if someone else does, we will make it known that you acted with our authorization. Good faith means that you:
- access only what you need to show the vulnerability, and stop and tell us as soon as you reach data that is not yours;
- do not change, delete or keep other people's data;
- do not degrade the service for anyone else;
- give us reasonable time to fix the issue before you disclose it.
We can authorize research only on the systems Korso runs. We cannot authorize testing of the systems of the providers we build on, such as Vercel or Google Cloud; their own policies govern that.
4. Out of scope
- Social engineering, such as phishing our team or our users.
- Denial of service, including load or volume testing.
- The Korso desktop app, which we discontinued on November 3, 2026.
5. What happens next
We read every report, and we reply within 5 business days to confirm we have it and tell you what we plan to do. We keep you informed until the issue is fixed, and with your permission we credit you once it is.