KiT is a small local Windows program. It holds no accounts, keeps no server, and opens the network only for the opt-in Check for updates… path, which talks to this repository's GitHub Releases and nothing else. The full account of what it does and refuses to do is in Trust.
If you believe you have found a security issue in KiT, please report it privately through Report a vulnerability with the version (tray menu shows it), what you saw, and how to reproduce it. Only you and the maintainer see it. Anything safe to discuss in public can go in a GitHub issue.
You can expect an acknowledgement within a few days. Fixes ship as a normal release with SHA-256 digests beside the files.
Every release publishes KIT-Setup.exe and KIT.exe with matching .sha256 files. Compare before you run: download the .sha256 beside the file, then in PowerShell in that folder:
(Get-FileHash .\KIT-Setup.exe).Hash -eq (Get-Content .\KIT-Setup.exe.sha256).Trim()True means the file is the one the release published. For the portable, put KIT.exe in both places.
The tray updater refuses any download that is not served from GitHub Releases, enforces a size cap, and verifies the SHA-256 digest before it replaces the running copy.
In scope: the shipped KIT.exe / KIT-Setup.exe, the updater, and the manifests published here (Scoop bucket, winget).
Out of scope: Windows and other third-party software on your machine, and issues that require an already-compromised user account.
KiT · Freeware