Buying a digital product can mean opening a stranger's files on your machine or loading them into your agent. That makes every digital marketplace a target for malware, and a review before publication is only as strong as the engineering behind it. Kurodyne is engineered in layers, from the files sellers upload to the database behind your account, so no single control has to stand alone.
Kurodyne reviews every listing and every update by hand before it's published. Multiple detection engines scan packages for malware, with escalation to OpenAI Daybreak for deeper analysis. Archives are validated against malicious structures.
Approved releases are locked. Each package has a SHA-256 fingerprint, so you can use the File Verifier to confirm that your download matches the approved package.
Kurodyne runs on Cloudflare's global network, with the application hosted on DigitalOcean and the database on Supabase. Every request to the application passes through Cloudflare first, where a web application firewall and DDoS mitigation filter malicious traffic. Connections use TLS, HSTS keeps browsers on HTTPS, and the domain is signed with DNSSEC.
Data is encrypted in transit with TLS, and the database and file storage are encrypted at rest with AES-256. Access control is enforced inside the database itself: every table the application's API can reach enforces Row Level Security, and all other data is closed to the API entirely. Permissions are denied by default and granted explicitly.
Every table has a defined retention rule, and scheduled jobs delete or redact expired records automatically. The Privacy Policy lists how long each kind of record is kept. The database is backed up.
Every protected request is authorized on the server, and the database enforces the same rules a second time. A strict, nonce-based Content Security Policy blocks scripts the server didn't authorize, security headers prevent framing and content sniffing, and input is validated on the server before it's used. Outbound requests to addresses that third parties supply are restricted to the public internet, which guards against server-side request forgery.
Uploaded images are decoded and re-encoded before publication, which strips metadata and anything embedded in the original file. Rate limits and CAPTCHA protect sign-in and other sensitive actions from abuse.
Accounts can be protected with two-factor authentication, which is then enforced across the site, downloads, and the database itself. Passwords are stored as one-way hashes and checked against known data breaches.
We email you whenever your password, email address, or two-factor setting changes. You can review active sessions and sign out of other devices at any time, and changing your password or email address signs out every other session.
AI clients connect through Kurodyne's own OAuth authorization server, which requires PKCE and binds every credential to a single resource. Each connection receives only the permissions you approve, access tokens are short-lived, refresh tokens rotate on every use, and you can revoke a connection at any time. We instruct connected AI clients to treat content written by other users as untrusted data, never as instructions, and responses that return Catalog listings or buyer messages also label that content as untrusted. Both measures help agents resist prompt injection.
Payments are processed by Stripe. Card details are entered directly into Stripe, so Kurodyne never receives or stores card numbers. Each sale is charged directly to the seller's own Stripe account, and Kurodyne never holds sale funds.
Every release passes automated security checks, including static analysis that blocks unsafe coding patterns. Code and database changes are version-controlled and released through a documented process, and dependencies are pinned, with safeguards against compromised packages.
Errors, performance, and uptime are monitored, and current availability is published on the status page (opens in a new tab). The configuration of every infrastructure provider is audited against its expected state.
If an incident affects personal data, we contain it, preserve the evidence, and give every notice the law requires, as the Privacy Policy describes.
We work with independent security researchers through a public bug bounty program (opens in a new tab). Good-faith research within the program's rules is authorized under the Terms of Use and protected by safe harbor. Our security.txt follows RFC 9116, and you can also reach us at support@kurodyne.com.