Security

Reporting a problem

If you think you have found a security issue in Kaptcho or kaptcho.com, please email [email protected]. Include what you found, how to reproduce it and the version of the app. We will reply as soon as we can, keep you updated, and credit you if you would like.

Please give us a reasonable time to fix a problem before you share it, and do not access or change other people's data while testing.

How Kaptcho keeps things safe

• Your media stays on your computer unless you turn on Drive for a project.
• Sign-in happens in your browser through Viremail. Kaptcho never sees your password.
• Sign-in tokens are kept in your computer's own secure storage, such as the macOS Keychain.
• Licence tokens are signed, and the app checks the signature on your computer.
• Connections to Viremail use HTTPS.
• The website sends modern security headers and uses no third-party scripts.

Unsigned builds

The installers are not code-signed yet. Until they are, please download Kaptcho only from the Viremail Store, which is linked from this site. Signing is coming soon.