Security as a product requirement
T2 Pinans, Inc. treats security as an ongoing product, engineering, operational, and governance responsibility rather than an optional feature or one-time review.
Security decisions for KISSit.ai products are guided by principles including least privilege, secure defaults, defense in depth, explicit authorization, data minimization, isolation, verification, auditability, controlled change, and user confirmation for consequential actions.
No security architecture can eliminate every risk. Controls are reviewed and improved as products, infrastructure, threats, dependencies, and legal requirements change.
Scope
This Security page applies to KISSit.ai websites, KISSit Terminal Free, other KISSit.ai software, private beta programs, protected downloads, support and feedback channels, release infrastructure, and related systems operated by or on behalf of T2 Pinans, Inc.
Third-party operating systems, command-line tools, repositories, package managers, networks, cloud platforms, websites, and services used with KISSit.ai products maintain their own security responsibilities and controls.
Local-first security model
KISSit Terminal Free is designed as a local-first desktop application. Terminal workspaces, commands, output, and application preferences are intended to remain on the user’s Mac unless the user deliberately exports, transmits, synchronizes, copies, or shares that information.
Normal local application use does not require KISSit.ai to receive terminal commands or resulting terminal output.
Commands executed by a user may independently communicate with local or remote systems, repositories, websites, package managers, networks, or third-party services. The user remains responsible for understanding and authorizing those communications.
Desktop application isolation
KISSit Terminal Free uses Electron security boundaries intended to reduce unnecessary access between the application interface and privileged operating-system capabilities.
The application enables context isolation, disables direct Node.js integration in the renderer, uses a sandboxed renderer environment, and exposes approved functionality through a limited preload interface.
Privileged operations should be performed through explicitly defined and validated inter-process communication paths rather than through unrestricted renderer access.
Browser and renderer protections
KISSit.ai desktop products seek to limit renderer privileges and avoid exposing unnecessary operating-system, file-system, process, or network capabilities to web-rendered content.
Navigation, external links, window creation, remote content, and privileged actions should be limited to approved destinations and validated application workflows.
Untrusted content should not be granted direct access to privileged application functions.
Command execution boundaries
KISSit Terminal Free provides an interface for executing commands selected, entered, pasted, generated, or approved by the user.
The application does not guarantee that a command is safe, accurate, reversible, authorized, or appropriate for the user’s environment.
Users should review a command’s target, privileges, dependencies, side effects, network activity, data impact, and rollback requirements before execution.
Destructive actions and confirmation
Actions that may delete application state, reset workspaces, terminate active processes, remove terminal sessions, or otherwise cause significant loss should use clear confirmation and warning mechanisms where appropriate.
Confirmation controls reduce accidental execution but do not replace backups, operational review, change approval, least privilege, or user responsibility.
Warm and cold start controls
Where supported, warm-start behavior is intended to preserve eligible application state and terminal workspace information across ordinary application restarts.
Cold-start or reset operations may remove or reinitialize stored application state and should provide an appropriate warning before destructive changes are applied.
Users remain responsible for preserving important files, commands, output, credentials, and operational records outside the application when continued availability is required.
Credential and secret protection
Users must protect passwords, private keys, recovery codes, certificates, access tokens, session credentials, environment variables, connection strings, protected download links, and other secrets used through or alongside KISSit.ai products.
Secrets should not be committed to source control, pasted into untrusted commands, embedded in screenshots, included in public logs, or submitted through ordinary support or feedback forms.
KISSit.ai products cannot protect credentials that a user intentionally or accidentally exposes to commands, processes, files, third-party tools, remote services, or unauthorized persons.
Least privilege
Users should run commands and applications with the minimum privileges necessary for the intended task.
Administrative, root, sudo, production, database, cloud, signing, deployment, and security credentials should be used only when required and only within an authorized scope.
Long-lived or broadly privileged credentials should be avoided where shorter-lived, narrowly scoped, or task-specific access is available.
Software dependencies
KISSit.ai products may depend on open-source libraries, frameworks, runtimes, build tools, operating-system components, and third-party services.
T2 Pinans, Inc. may review, update, replace, restrict, or remove dependencies in response to vulnerabilities, compatibility requirements, maintenance status, licensing considerations, or operational risk.
A dependency update may require application changes, testing, release validation, or compatibility adjustments before distribution.
Secure development and change control
KISSit.ai development practices may include source control, change review, branch protection, automated validation, linting, builds, tests, dependency review, release verification, deployment controls, and post-deployment checks.
Changes affecting authentication, authorization, data processing, downloads, tokens, releases, privileged operations, infrastructure, or security boundaries should receive additional scrutiny appropriate to their risk.
Production changes should be traceable to an approved source revision and deployed through controlled procedures where available.
Build and release integrity
KISSit.ai release processes seek to preserve traceability between source code, build configuration, version identifiers, release records, downloadable files, and published integrity information.
Release files may include version numbers, build identifiers, file sizes, cryptographic checksums, compatibility information, release notes, and distribution status.
Users should obtain software only from approved KISSit.ai sources and verify published release information when verification data is available.
Update security
KISSit Terminal products should retrieve release information only from approved KISSit.ai infrastructure or another explicitly authorized source.
Release metadata should be validated before an update or download is presented to the user. Update destinations should be restricted to approved locations.
An update notice does not authorize silent execution of unrelated commands, installation from an unverified source, or bypassing operating-system security controls.
Protected downloads
Private beta and other restricted releases may use tester-specific access, expiring tokens, release status controls, download validation, integrity information, and audit records.
Protected links, tokens, release files, and unreleased information must not be shared with unauthorized persons.
T2 Pinans, Inc. may revoke, expire, restrict, or suspend protected download access when necessary to protect releases, investigate misuse, enforce applicable terms, or address security risk.
Website and infrastructure security
KISSit.ai may use access controls, network protections, secure transport, service isolation, logging, monitoring, backups, deployment controls, rate limiting, security headers, and other safeguards appropriate to the applicable website or service.
Infrastructure access should be limited to authorized personnel and services using appropriately scoped credentials.
Security events, maintenance, third-party failures, configuration errors, software defects, or circumstances beyond reasonable control may affect service availability despite implemented safeguards.
Production data separation
KISSit.ai production application services and production database services may be hosted on separate systems to reduce unnecessary exposure and support controlled network access.
Database access should be limited to authorized application sources, administrative workflows, and approved credentials using appropriate authentication and encrypted transport where configured.
Infrastructure separation reduces certain risks but does not remove the need for access control, patching, monitoring, backups, secret management, and incident response.
Transport security
KISSit.ai services should use encrypted transport where appropriate to protect information transmitted between users, application services, data services, and authorized service providers.
Users should verify that they are connecting to an approved KISSit.ai domain or service before entering information or downloading software.
Encryption in transit does not protect information after it has been lawfully decrypted on an endpoint or disclosed through compromised credentials, malicious commands, unsafe devices, or unauthorized recipients.
Logging and monitoring
KISSit.ai systems may maintain limited service, access, download, security, error, deployment, and audit records when reasonably necessary to operate services, detect misuse, investigate incidents, verify releases, diagnose failures, and comply with legal obligations.
Logging and monitoring should be proportionate to the relevant purpose and handled in accordance with the KISSit.ai Privacy Policy and Data Retention Policy.
Sensitive information should not be intentionally placed in logs unless necessary, authorized, and protected through an approved process.
Backups and recovery
T2 Pinans, Inc. may maintain backups or recovery procedures appropriate to the applicable website, infrastructure, service, or business record.
Backup controls may include restricted access, encryption where appropriate, retention limits, restoration testing, integrity checks, and secure disposal.
Users are responsible for maintaining their own current, tested, and recoverable backups of local files, terminal work, configurations, credentials, and system state.
Security incident response
T2 Pinans, Inc. maintains or develops procedures intended to identify, assess, contain, investigate, document, remediate, recover from, and learn from security incidents affecting KISSit.ai systems or information.
Incident response may include access restriction, token revocation, credential rotation, service isolation, evidence preservation, log review, vulnerability remediation, restoration, user communication, and coordination with service providers or authorities.
The response will depend on the nature, severity, scope, impact, affected systems, available evidence, legal requirements, and risk to users or infrastructure.
Personal data breaches
A security incident involving personal information will be assessed under the KISSit.ai Privacy Policy, applicable incident-response procedures, and Philippine privacy requirements.
Where notification is legally required, T2 Pinans, Inc. will seek to notify the National Privacy Commission and affected individuals in the manner and within the period required by applicable law.
Not every security event constitutes a reportable personal data breach. Relevant incidents should still be documented, evaluated, and handled according to their risk and applicable requirements.
Responsible disclosure
Security researchers and users are encouraged to report suspected vulnerabilities affecting KISSit.ai products or services promptly and privately.
A report should provide enough detail to understand and reproduce the issue, including the affected product or service, version, environment, steps to reproduce, observed impact, relevant evidence, and suggested mitigation when available.
Reports should avoid unnecessary collection, access, modification, retention, or disclosure of personal information, credentials, confidential information, production data, or another person’s content.
Where to send a security report
Security reports may be sent to support@kissit.ai with a subject line that clearly identifies the message as a security report.
Include a reliable method of contact so that T2 Pinans, Inc. can request clarification or provide an update when appropriate.
Do not send active malware, executable exploit code, credentials, private keys, access tokens, regulated information, or confidential terminal output through ordinary email unless specifically requested through an approved secure method.
Research boundaries
Do not perform vulnerability scanning, penetration testing, exploit testing, credential testing, load testing, fuzzing, automated enumeration, or other security assessment against KISSit.ai systems without prior written authorization unless the activity is expressly permitted by published security documentation.
Do not access unrelated accounts or information, establish persistence, alter or destroy data, disrupt service, evade controls, exfiltrate information, expand testing beyond what is necessary to confirm an issue, or publicly disclose an unresolved vulnerability.
Good-faith intent alone does not authorize activity outside an approved scope.
No automatic safe harbor or bounty
Submitting a vulnerability report does not automatically create a safe-harbor, bug-bounty, confidentiality, employment, agency, partnership, or compensation agreement.
Any authorization, testing scope, disclosure schedule, reward, recognition, or other commitment must be expressly confirmed in writing by an authorized representative of T2 Pinans, Inc.
Disclosure coordination
T2 Pinans, Inc. may request reasonable time to investigate, reproduce, contain, remediate, test, and deploy a correction before public disclosure.
The appropriate disclosure schedule may depend on severity, exploitability, affected users, availability of mitigations, dependency coordination, release readiness, legal requirements, and active exploitation.
T2 Pinans, Inc. does not guarantee that every report will result in a product change, public advisory, recognition, compensation, or response within a specific period.
What happens after a report
T2 Pinans, Inc. may acknowledge a report, request additional information, attempt reproduction, assess severity and scope, coordinate remediation, prepare a release or mitigation, notify affected parties where appropriate, and document the outcome.
Duplicate, incomplete, unverifiable, out-of-scope, purely theoretical, informational, or previously known reports may be closed without further action.
Information about internal systems, investigations, security methods, affected parties, legal advice, or remediation details may be withheld when disclosure would create risk or violate an obligation.
User security responsibilities
Users are responsible for securing their devices, operating systems, accounts, terminal environments, networks, backups, credentials, repositories, remote services, and installed software.
Users should apply security updates, use supported software, protect administrative access, review commands before execution, verify downloads, use least privilege, maintain backups, and remove access that is no longer required.
Users must report suspected compromise of a protected KISSit.ai download token or access mechanism promptly.
Third-party services
KISSit.ai products may interact with third-party operating systems, tools, package managers, repositories, websites, APIs, networks, cloud platforms, and services.
T2 Pinans, Inc. does not control the security of independent third-party products or services and cannot guarantee their availability, integrity, confidentiality, or behavior.
Users should review third-party security documentation, permissions, updates, terms, and privacy practices before use.
Security limitations
No application, website, network, encryption method, authentication system, development process, monitoring platform, backup, or security control can guarantee complete protection against every vulnerability, attack, failure, misuse, or data loss event.
Security information on this page describes intended principles and practices and does not constitute a warranty that a product or service is free from vulnerabilities or will prevent every incident.
Changes to this Security page
T2 Pinans, Inc. may update this Security page to reflect changes in products, architecture, infrastructure, security controls, operational practices, threats, laws, regulations, or reporting procedures.
The current version will identify its effective date and last-updated date. Material changes may also be communicated through the website, software, release information, email, or another appropriate notice mechanism.
Relationship to other policies
This Security page should be read together with the KISSit.ai Terms of Use, Privacy Policy, Usage Policy, Cookie Policy, Data Retention Policy, private beta terms, and any product-specific or release-specific security information.
The Usage Policy governs authorized and prohibited conduct. The Privacy Policy explains the processing and protection of personal information. The Terms of Use establish the contractual framework for KISSit.ai products and services.
Contact
Security questions and suspected vulnerabilities may be reported to support@kissit.ai.