Security

How to report

Email security@guilderworks.com. Please include:

• the product and version (shown in its About window), and your Windows version;
• what the problem is and what an attacker could do with it;
• the steps to reproduce it, or a proof of concept;
• whether you want to be credited when the fix is published, and under what name.

Please don't send license keys, passwords or other personal data in a report, and don't use the general support address for security problems.

What happens next

• Within 5 working days we confirm that we received your report, and tell you whether we can reproduce it.
• Serious problems get a security fix as quickly as we can, usually within days, on every release line that still receives security fixes. Less serious ones are fixed in the next regular release.
• We keep you informed until the fix is out, and agree with you when the problem can be made public. We ask for up to 90 days to release a fix.
• Each security fix is announced on the updates page, saying what it fixes, which versions are affected and how to install it. With your permission, we credit you there.
• If a vulnerability is being actively exploited, we also report it to the authorities, as the EU Cyber Resilience Act requires.

Which versions

Security fixes are released for every release line until its end date on the updates page. Reports about a line past its end date are still welcome; we will say whether a newer line is affected.

Testing in good faith

We will not take legal action against research that is done in good faith and within these limits:

• test only on your own computers and with your own copy of the software;
• on this website, don't disrupt the service, don't access or change data that isn't yours, and stop as soon as you have shown the problem;
• give us a reasonable time to fix the problem before you disclose it.

We are a one-person business and cannot offer a bug bounty, but we are grateful for every report.