If you discover a security vulnerability in SubscripKiller, please report it responsibly.
Email: molly@lynote.ai
Please include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
We will acknowledge your report within 48 hours and aim to release a fix within 7 days for critical issues.
SubscripKiller is designed with privacy and security as core principles:
- Client-side processing: Bank statement parsing happens in the browser using PDF.js and PapaParse. Raw financial data is never sent to our servers.
- Subscription matching: The matching engine runs server-side but only receives extracted transaction descriptions, not full bank statements.
- Authentication: Powered by Auth.js (next-auth v5) with secure session management.
- Payments: Handled entirely by Stripe. We never store card details.
- Database: Only stores user accounts and scan report summaries (not raw bank data).
| Version | Supported |
|---|---|
| Latest | Yes |
The following are in scope for security reports:
- Authentication/authorization bypasses
- Data exposure or leakage
- Cross-site scripting (XSS)
- SQL injection
- Server-side request forgery (SSRF)
Out of scope:
- Issues in third-party dependencies (report to the upstream project)
- Social engineering
- Denial of service