Account-owned knowledge bases
Your knowledge bases, conversations, and downloads belong to your account. Only the signed-in owner can see or change them.
Security overview
Private access with explicit data boundaries.
How kbDrop keeps accounts isolated, stores files privately, scopes API keys, shares data with model providers, and limits what the crawler and parsers can do.
Keys scoped to one knowledge base
API keys are stored as hashes, shown in full only once, rate limited, and revocable one by one. A key can never read another knowledge base.
Secure, private storage
Your original files are kept in private storage. Downloads use short-lived signed links, never public URLs.
Bounded source processing
Uploads, ZIPs, media, and crawls are validated and capped by account limits before any work starts.
Model-provider boundary
Private does not mean provider-local.
kbDrop uses a model provider to index sources and answer questions. Your question, the relevant excerpts, recent conversation context, and selected images are sent to that provider when needed.
Your full library is never made public, and originals stay behind signed, authenticated access. Upload with that boundary in mind.
Current hardening status
Limits are defenses, not a malware sandbox.
kbDrop checks file signatures and media structure, rejects unsafe ZIP entries like nested or encrypted archives, caps how much work one upload can create, and isolates processing. It is not yet a hardened sandbox for hostile files; malware scanning and stronger parser isolation are still on the roadmap.
Website crawling screens every destination and redirect, fetches only public HTTP(S) pages, and identifies itself to publishers with full robots.txt support.
Read the crawler policyFound a security issue?
Don't put secrets or exploit details in a public issue. Contact the repository owner privately with what's affected, how to reproduce it, and the impact.
Create an account