Security model
Local processing
Filtering, DNS checks and AI analysis happen on your device.
Minimal permissions
The Standard edition requests only what core protection needs.
Auditable code
The full source is public, so researchers can review every line.
Verify your download
Only install APKs from the official GitHub Releases page. You can inspect the signing certificate before installing:
apksigner verify --print-certs KotSafe-standard-release.apk
Compare the certificate fingerprint across releases. It should never change between versions.
Known limitations
- Apps that pin their own certificates cannot be decrypted by HTTPS inspection.
- Android allows one active VPN at a time, so KotSafe cannot run alongside another VPN app.
- KotSafe is in beta. Do not rely on it as your only defence.
Responsible disclosure
If you find a vulnerability, please report it privately first. Email [email protected] or use a private security advisory on GitHub. Include steps to reproduce and the affected version.
- We acknowledge reports promptly and keep you updated on the fix.
- We credit researchers who report in good faith, if they wish.
- Please avoid accessing data that is not yours and give us reasonable time to fix before publishing.
Our contact details are also published in security.txt.