Scope: This document applies only to app.keydir.in and its related services.
The best security measure the platform has is simplicity. The documentation site is static with no server-side processing, account data is held only where the app requires it, and there is no payment processing. There is little to break because there is little to attack.
SECTION_01 Our Approach
The platform's security model is built on three ideas:
- Minimize — we collect the least data possible (see the Privacy Policy).
- Defer — the site is served from static hosting infrastructure maintained by a large provider with dedicated security teams.
- Disclose — real vulnerabilities get fixed, acknowledged, and thanked, not ignored.
SECTION_02 What We Protect
- The documentation site — served over HTTPS only, with no login and no stored user data.
- The app — account credentials and personal data at app.keydir.in, protected by the app's authentication and its infrastructure provider's controls.
- The application codebase — maintained with security tooling and reviewed before release.
- You — the community, against scams and phishing that misuse the KeyDir name.
SECTION_03 Platform Security
| Measure | What it does |
|---|---|
| HTTPS everywhere | All traffic is encrypted; the site is configured to use HTTPS. |
| Static hosting | No application server, no server-side processing, no database on the documentation site. |
| Minimal JavaScript | Scripts are small, first-party, and auditable. |
| Managed credentials | Where the app requires authentication, passwords and sessions are handled by the app's platform provider's security controls — never stored in the site. |
| Escalation | We do not store passwords or personal data server-side on the documentation site. |
SECTION_04 Your Account
If you use the app with an account, protect it:
- Use a strong, unique password and do not reuse it across sites.
- Enable any two-factor authentication the app offers.
- Never share your credentials, including with someone claiming to be a KeyDir representative — KeyDir will never ask for your password.
- If you believe your account was compromised, report it immediately through the Report Abuse page.
SECTION_05 Phishing & Scams
KeyDir will never ask you for passwords, OTPs, or payment "to keep your listing live". No one can buy organic placement on the platform. Treat any such request as a scam and report it.
Scammers sometimes impersonate community platforms. Key facts to check:
- The official directory is keydir.in; the official app is app.keydir.in. Verify the domain before entering credentials.
- KeyDir never collects advance payment for organic listings, flags, or placement.
- Legitimate communications come from the official email address, officialkeydir.in@gmail.com.
SECTION_06 Responsible Disclosure
If you find a security vulnerability in the documentation site, this site, or the app, please follow the Responsible Disclosure process. In short:
- Email the details to officialkeydir.in@gmail.com with the subject
[SECURITY]. - Include a clear description, steps to reproduce, and the impact you observed.
- Give us a reasonable period (we suggest at least 30 days) to fix the issue before public disclosure.
- Do not access or exfiltrate data beyond what is needed to demonstrate the issue, and do not disrupt the service for others.
SECTION_07 What to Expect
- Acknowledgement — we confirm receipt of valid reports, usually within a few days.
- A fix — we work on a resolution and credit you if you wish.
- No bounty — this is a small platform without a bug-bounty budget. Our thanks and credit are what we can offer.
Testing the live service beyond demonstrating a vulnerability, without coordination, may violate the Acceptable Use Policy. Coordinated, good-faith testing is welcome.
SECTION_08 Contact
Security reports: officialkeydir.in@gmail.com (subject [SECURITY]), or use the Contact page.