Security: report a problem

Last reviewed 16 October 2026.

If you think you have found a weakness in KolTheia, please tell us. A machine-readable version of this page is at /.well-known/security.txt.

How to report

Write to koltheia@ottxp.com with "Security" in the subject. Say what you found, where, and how to repeat it. Please do not post it publicly until we have had a chance to fix it. Do not send anyone's photos, videos or private data: describe it instead.

What we promise

• We will acknowledge your report within 7 days and tell you what we decide.
• We will not take legal action against you, or ask the authorities to, for good-faith research that follows the rules below.
• If you want it, we will credit you when we publish the fix.
• KolTheia is run by one person and has no company or budget yet, so there is no paid bounty.

The rules for good-faith research

• Test only with your own account and your own captures.
• Do not read, change or delete other people's data, and stop as soon as you see it is possible.
• No denial-of-service, flooding, mass sign-ups, or automated guessing of codes or passwords.
• No social engineering of other people, and no physical attacks.
• Tell us what you did, and give us time to fix it before telling anyone else.

What is in scope

This site and its sign-in, capture, certificate and verification pages. Weaknesses that would let someone forge or alter a seal, read another person's data, sign in as someone else, or get past the sign-in limits are the ones that matter most.

Not a security problem

KolTheia says plainly what it cannot prove (see the guide): a seal does not show that a scene was real. That limit is not a vulnerability. Findings that rely on a device you have already fully taken over are also not in scope.