Skip to content
korAPI

Privacy and security

  • korAPI has no account and no telemetry. It connects only to the servers in the requests you send.
  • Secrets are kept only in your system keychain, never in a file korAPI writes: not in the collection, environments, history, logs, reports or exports.
  • The window never receives a stored secret unless you press Reveal.
  • Environments marked as production are locked until you unlock them, and load tests never run against them.
  • Scripts cannot read files or reach the network except through api.sendRequest, and stop after 10 seconds.
  • HTML reports hold no scripts and load nothing.

Found a security problem? Report it privately from the Security tab of korapi-releases, not as an issue.