Security

Security

Last updated September 25, 2026

This page explains how kalyxosec.com protects the people who visit it, and how to report a security issue to us. If you think you have found a vulnerability, email security@kalyxosec.com.

How this website protects you

Kalyxo is a Mac app, in early access, that checks what AI agents do on your computer. This section covers the website and the waitlist. The app will ship with its own privacy terms.

• HTTPS everywhere. All traffic to and from kalyxosec.com uses HTTPS.
• No third-party scripts. Fonts, scripts and images are all served from kalyxosec.com. The site loads no ad networks and no social pixels.
• Minimal data. The waitlist form stores the email address you type, which button opened the form, the approximate country Cloudflare derives from the request, your device type, and the date and time. If you accepted analytics, it also stores the campaign tags in the link you arrived from and the referring site's domain. Analytics run only if you click Accept, and are kept as daily totals with no cookies and no identifiers.
• Salted hashing for abuse prevention. For each waitlist submission, the server keeps a salted one-way hash of your IP address for 24 hours to limit repeated submissions, then deletes it. The raw IP address is not stored. Short in-memory rate limits use the same kind of salted hash.
• Access limited to the team. Only the Kalyxo team can access the data we store.

Cloudflare hosts the site and stores its data using Cloudflare Workers and Cloudflare D1. Cloudflare processes IP addresses to deliver and protect the site, and may set strictly necessary security cookies, such as __cf_bm, to filter automated traffic. Kalyxo keeps no request logs of its own.

For the full list of what we collect and why, read our Privacy Policy.

Vulnerability Disclosure Policy

We welcome reports from security researchers. If you believe you have found a security issue in kalyxosec.com or the Kalyxo Mac app, please tell us so we can fix it. This policy explains how to report, what you can expect from us, and the rules we ask you to follow.

How to report

Email security@kalyxosec.com. A useful report includes:

• Steps to reproduce. A clear sequence we can follow, with any requests, payloads or screenshots that help.
• Impact. What an attacker could do with the issue, and who it would affect.
• Affected URLs or versions. The pages or endpoints involved, or the version of the Kalyxo Mac app you tested.

If you are unsure whether something is in scope, email us before you test.

What we commit to

• Acknowledge your report within 3 business days.
• Keep you updated on the status of your report.
• Credit you publicly for the finding, if you want us to.
• Offer safe harbor for good-faith research that follows this policy, as described below.

Scope

The following are in scope:

• kalyxosec.com, the Kalyxo website and waitlist.
• The Kalyxo Mac app, for early access users.

The following are out of scope:

• Denial of service or load testing.
• Spam.
• Social engineering or phishing of Kalyxo staff.
• Physical attacks.
• Attacks on Cloudflare or other third-party infrastructure.
• Findings from automated scanners without a demonstrated impact.

Rules of engagement

• Do not access or modify other people's data beyond the minimum needed to show the issue.
• Once you reach sensitive data, stop and report the issue to us.
• Give us reasonable time to fix the issue before you disclose it publicly.
• Stay within the scope above, and avoid the out of scope activities listed.

Safe harbor

Kalyxo offers safe harbor for good-faith security research that follows this policy. If you follow the rules above, we will treat your research as authorized and will not pursue legal action against you over it.

If you are ever unsure whether an action fits these rules, stop and ask us at security@kalyxosec.com first.

Recognition

With your permission, we will credit you publicly for a valid finding. Kalyxo does not run a paid bug bounty program at this time, so we do not pay for reports.

security.txt

Our security contact is also published in machine-readable form at /.well-known/security.txt, following RFC 9116.

Contact

This website is operated by Wend Labs Inc., doing business as Kalyxo.

• Security reports: security@kalyxosec.com
• Privacy questions: privacy@kalyxosec.com