~/security
Security
A summary for IT and security teams reviewing kittybin for use at work.
Architecture
- kittybin is a static website. Every tool runs as JavaScript and WebAssembly inside the visitor's browser.
- Files and text entered into a tool are processed in memory on the visitor's device and are never transmitted to kittybin.
- The site is served over HTTPS only, with HSTS.
Network access
Each tool page carries its own Content Security Policy. Tool pages may load only kittybin's own scripts and styles, and almost all of them are blocked from making any network connection at all.
The one exception is the expiry checker, which needs to look up public records. It contacts IANA's RDAP directory, the registry's public RDAP server for each domain checked, and the Cert Spotter certificate transparency API. Only the domain names you enter are sent, never files.
What we never use
- No third-party scripts, analytics tags or ad networks.
- No cookies. Your theme choice is stored in your own browser's local storage.
- No accounts, so there are no passwords or personal profiles to protect.
What we do see
Like any website, our host processes standard request data such as IP addresses to deliver pages. We count page views by path, without cookies and without storing IP addresses. Messages sent through the feedback form reach the kittybin team by email. See the privacy policy for details.
Other headers
Pages cannot be framed by other sites, MIME sniffing is disabled, referrers are trimmed when leaving the site, and camera, microphone, location and payment features are disabled unless a tool needs them.
Reporting a vulnerability
Email security@kittybin.app with the details and steps to reproduce. We will acknowledge your report and keep you updated while we fix it. Our security.txt lists the same contact.