Supported versions
Security fixes are applied to the latest main branch of the Koko repository. There are no long-term support branches at this stage of the project.
Reporting a vulnerability
Please do not file public GitHub issues for security bugs.
Send reports privately to security@kokoio.com.
Include as much of the following as you can:
- Description of the issue and impact (RCE, sandbox escape, memory safety, etc.)
- Steps to reproduce on a current
maincheckout - Koko version or git commit hash
- Platform (OS, CPU arch) and build mode (Debug / ReleaseFast)
- Proof-of-concept if available — minimize harm to third parties
What we consider in scope
- Memory safety issues in the Zig/V8/runtime boundary
- Sandbox or realm isolation failures
- CDP/MCP endpoints exposing unintended privilege escalation
- TLS or network stack misbehavior shipped in Koko binaries
- Supply-chain issues in first-party Koko build scripts (case by case)
Out of scope (usually)
- Websites you automate behaving maliciously — that is the target site's problem
- Captcha or bot-detection bypass as a "vulnerability" in Koko
- Issues in upstream Chromium/V8 already tracked upstream (we may still cherry-pick fixes)
- Denial of service from intentionally hostile pages without a novel engine bug
Disclosure timeline
We aim to acknowledge reports within a few business days. Coordinated disclosure depends on severity and fix complexity. We credit researchers in release notes when they agree — anonymous disclosure is respected if you request it.
Secure development practices
Runtime
Zig safety checks, isolated test probes, CDP budget timeouts on scripts.
Automation tests
code-check/ lifecycle and fingerprint regression suites.