Security
We build apps that hold people's phone numbers, payments, photos and identity documents. Keeping that data safe is part of the job, not an extra.
Who leads it
Security at Retriever Labs is led by Rohan Bhaju, Founder & Security Lead. He owns security review, access control and incident response for everything we ship.
What is in scope
Our own products and the infrastructure behind them: the Seep and Pasal apps for iOS and Android, their web apps, the Kepto document vault, their Supabase backends, and this site. We do not test systems we do not own or have not been engaged to protect in writing.
Why it matters here
Nepal is going digital fast, and attacks are keeping pace. A few recent, public examples:
- October 2026. Pathao Nepal confirmed a cyber attack that exposed names, emails and phone numbers of thousands of users. Ratopati
- September 2026. A ransomware attack on the data hub behind NEPSE share trading stopped the trading systems of 72 brokers, and investors could not trade for a full day. Ratopati
- August 2026. After Nepal joined Have I Been Pwned, the National Cyber Security Centre found at least 135 nepal.gov.np email accounts exposed in breaches, including staff at the Prime Minister's Office and the Home, Finance and Foreign ministries. The Kathmandu Post
- 2025. More than 400 government websites went down in one attack on the government data centre, the Hello Sarkar database was stolen, and citizenship records were offered for sale after a breach of the Nepal Police website. Ratopati
Most of these came down to the basics: unpatched servers, weak access control, reused passwords and data kept longer or wider than it needed to be. Small companies and the apps that serve them are targets too, often because they are assumed to be easy.
How we work
Every table in our backends is locked down with row-level security, and we audit those rules: one audit found and closed a privilege-escalation path before it was exploited. Identity and verification documents live in private storage, never public buckets. Admin access is limited to the people who need it.
We use AI-assisted code review, including Claude from Anthropic, to look for vulnerabilities in our own code, verify fixes and check dependencies. That work is defensive and limited to the scope above.
Report a vulnerability
If you find a security problem in this site or in Seep, Pasal or Kepto, email rohan@retrieverlabs.net. Include the steps to reproduce it. We reply within three working days, keep you updated while we fix it, and credit you if you want. Please do not access other people's data or disrupt the service while testing, and give us a reasonable time to fix the issue before you publish it.
Last updated 19 October 2026.