← Home
Security and vulnerability policy
Tell us about a weakness. We take it seriously.
We want to hear about any security weakness in our software. This page says how to report it, what to expect, and how the software is built to limit risk.
How to report
Write to security@DOMAIN-TBD.example. Please include the product and version, the steps to reproduce the problem and what you saw. Please do not send real customer data. A machine-readable version of this page is at /.well-known/security.txt.
What happens next
- We confirm that we received your report.
- We reproduce and assess it.
- We fix it in a signed update and tell the customers who are affected.
- If you wish, we credit you when we publish the notice.
What we ask of you
- Test only your own installation. Do not access data that is not yours.
- Give us reasonable time to fix the problem before you publish details.
- Do not run attacks that disturb a production line.
How the software limits risk
- Runs on your own server. No cloud and no telemetry: it sends no usage data and no crash reports.
- Signed builds and signed updates. Updates are packages you choose to install.
- Licence keys are bound to your machine and checked offline.
- A tamper-evident audit log: records are chained with hashes, corrections are new entries and exports are signed.
- The offline AI assistant only suggests. A person decides.
This policy describes how we handle reports. It is not a legal agreement and not a guarantee of response times.