Security

Reporting a vulnerability

Email security@kaniyan.ai with enough detail to reproduce. We will acknowledge within two working days and keep you updated until it is closed. We will not pursue legal action against anyone who reports in good faith, avoids privacy violations and service degradation, and gives us reasonable time to fix the issue before disclosing.

Please do not run automated scanners or load tests against our infrastructure without asking first — not because we mind the scrutiny, but because it is indistinguishable from an attack and we will spend the night responding to it.

What is implemented

• A specification trust boundary. An agent is defined by a bounded, closed JSON charter. It selects models, tools, skills and data scopes by name, resolved server-side against an allowlist. A charter cannot express executable code, a URL, a credential, a model endpoint or a filesystem path. There is no dynamic import and no evaluation of submitted strings anywhere in the construction path, and the rejection of each attack class is covered by a named test.
• Tenant isolation at the database engine. Row-level security with forced policies, keyed on a per-request tenant, in addition to application-level scoping. Proven by an automated test per table.
• Contained code execution. Untrusted code runs in a per-conversation gVisor-isolated pod on a private cluster, with keyless workload identity (service-account key creation is blocked by organisation policy) and a default-deny egress policy with an explicit allowlist.
• Structural human approval. Consequential actions pause in the graph runtime, not in the prompt. There is no path for a model to release its own gate.
• Private data plane. Postgres has no public IP, connections are TLS-only, and the public website connects with a role that has SELECT on published content and nothing else — it cannot write, and cannot read a draft.
• Hardened edge. Global load balancer with a WAF and per-IP rate limiting; the application services are unreachable except through it. Strict transport security, a strict content-security policy and no inline script on the public site.
• Secrets discipline. Secret containers are declared in infrastructure code; values are generated out-of-band and never enter version control.

Where data lives

The platform’s primary region is asia-south1 (Mumbai). Model serving location is a server-side lookup per model, recorded per run, and a customer can restrict the allowed set to in-region models.