Security

This site is a set of static HTML pages. There is no server-side application, no database and no user input to attack. This page describes what that means in practice and how to report a problem if you find one.

In one line: static files, HTTPS only, no cookies, no accounts, no third-party scripts — so the realistic attack surface is the hosting platform, not the site's own code.

How the site is served

Pages are pre-built HTML, CSS and JSON-LD, served as files. Nothing is rendered on the server. There is no admin panel, no upload path, no query-string handler and no form that posts anywhere, which removes the usual injection and deserialisation classes of bug entirely.

Control	Status	Notes
Transport	HTTPS only	HTTP requests are redirected to TLS
Server-side code	None	Static files, no application runtime
Database	None	No stored user data to breach
Cookies	None	No session exists
Third-party JS	None	No analytics or ad scripts embedded
User input	None	No forms, search or comments
Security headers	Set at the edge	HSTS, nosniff, frame-ancestors 'none', restrictive CSP

Reporting a vulnerability

If you believe you have found a security issue, we would genuinely rather hear it from you than read about it. Please:

Email security@kimik31pro.com with a description, the affected URL and reproduction steps.
Give us a reasonable window (10 working days is a good default) to investigate and fix before publishing anything.
Test only what you need to demonstrate the issue. No denial-of-service, no volume scanning, no touching third-party accounts.
We will confirm receipt, tell you what we found and credit you on request once a fix is live.

Out of scope: missing headers we document above, clickjacking on pages with no state-changing action, autocomplete or TLS-configuration grade disputes, and reports generated purely by automated scanners without a demonstrated impact.

Scope note: this site versus the model

This page covers kimik31pro.com only. It is not a security channel for Kimi K3.1 Pro, Moonshot AI, or any Kimi API endpoint. Issues in the model or the vendor's platform should go to the vendor, not here — we cannot fix them and we cannot route them for you.

Related reading on this site: the model's deliberately reduced offensive-security capability at launch is discussed on the specs overview, and the terms of use explain acceptable use of this site.

Data handling

No credentials, keys or personal data are stored on this site. The full picture of what is and is not collected is on the privacy policy page.

Security notes · Last updated 24 October 2026 · kimik31pro.com