Security

How Ky protects your account and your music, and how to report a vulnerability.

Updated 25 October 2026

Design

• Nothing listens. Our analysis engines run on our own hardware with no inbound ports: they pull work from ky.ax over outbound HTTPS with a secret token, analyse, and post results. There is no tunnel into the machine that holds the catalogue.
• One small codebase. The site and API are a single Cloudflare Worker with no third-party authentication library; every line of the sign-in code is ours and reviewed.
• Hashed everywhere. Passwords are peppered with a server secret, salted and hashed (PBKDF2-SHA256). Session tokens, API keys and claim tokens are stored only as SHA-256 hashes, so a copy of the database cannot be used to sign in.
• Sign-in with Google uses the OpenID Connect authorisation-code flow with PKCE and a signed state; we never see your Google password.
• Browser hardening. A strict Content Security Policy (no inline scripts, no third-party scripts, no third-party fonts), HSTS, SameSite session cookies, same-origin checks on every state-changing request, no iframes.
• Private by default. Uploaded files and results are readable only by the account that made them (or, for an anonymous check, by whoever holds its claim token until the check is attached to an account). Results are never reused between accounts. Links to results are unguessable and never confirm whether an id exists.
• Least privilege. Each connected plugin gets its own API key, which you can revoke; keys are minted when the tool collects them and show only their first characters afterwards. A key can create checks and read the checks of its account.
• Logs. Security events (sign-ins, key creation, deletions) are logged with a salted hash of the IP address, kept 90 days.
• Dependencies. Static analysis (Semgrep), secret scanning (gitleaks) and dependency audits run on every change; secrets never live in the repository.

Reporting a vulnerability

Email security@ky.ax. Please include steps to reproduce. We will acknowledge within two working days, keep you informed, and credit you if you want. Please don't access other people's data, degrade the service, or publish before we've fixed it; in return we won't take action against good-faith research that follows these rules.