Kriya Vulnerability Disclosure

generated: '2026-07-19'
method: searched
probe: true
source: https://www.kriya.co/responsible-disclosure
policy:
- https://www.kriya.co/responsible-disclosure
contact:
- disclosure@kriya.co
security_txt: false
security_txt_note: >-
  No /.well-known/security.txt is published on any Kriya host — see
  well-known/kriya-well-known.yml. The policy is published as an HTML page instead.
bug_bounty:
  program: false
  platform: null
  rewards: false
  recognition: >-
    Kriya offers no financial rewards for submissions but states it is happy to thank
    every individual researcher whose report helps improve its security.
scope: >-
  Any website, application or service distributed or hosted by Kriya, or served under
  a domain owned by Kriya.
reportable:
- >-
  Vulnerabilities or breaches in Kriya software or environments threatening the
  confidentiality, integrity or availability of Kriya or customer data.
- >-
  Copycat applications, or phishing/vishing attacks against Kriya, customers,
  contractors or staff.
- >-
  Activity, discussion or data in any public forum constituting a threat to Kriya or
  its customers.
researcher_requirements:
- Do not put any Kriya or customer data at risk.
- Do not access, or attempt to access, data that does not belong to you.
- Do not engage in activity that may negatively affect Kriya or its customers.
- Do not break laws or breach agreements to discover vulnerabilities.
- Do not use social engineering against customers, contractors or staff.
- Do not share or publicise an unresolved vulnerability with third parties.
submission_requirements:
- Description of the location and potential impact of the vulnerability.
- Detailed steps to reproduce the issue.
- Any logs or other gathered materials collected.
- Reporter name, role if appropriate, and contact details.
response_commitment: >-
  Kriya commits to making reasonable efforts to respond quickly to responsibly
  submitted vulnerability reports. No specific SLA is published.
legal_note: >-
  Kriya states that it acts decisively on attacks and extortion attempts, including
  reporting them to the relevant authorities. Submitting a disclosure constitutes
  agreement to Kriya's Terms and Conditions and permits Kriya to use the submission
  to secure its technology and business. No safe-harbour clause is published.
legal_entity:
  name: Kriya Finance Limited
  registered_number: '07330525'
  jurisdiction: England and Wales
  registered_address: 4-5th Floor, 15 Worship Street, London, EC2A 2DT, United Kingdom
evidence:
- source: https://www.kriya.co/responsible-disclosure
  kind: disclosure page
  keywords:
  - vulnerability
  - responsible disclosure
  - security issue
  - disclosure@kriya.co
trust_center:
  found: false
  note: >-
    The security-programme probe found no trust center and no published
    certifications (SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP). trust.kriya.co and
    security.kriya.co do not resolve. No TrustCenter or Compliance pointer is emitted.