Reporting a security problem

Write to office@royalsoftworks.com and start the subject line with “Security:”. Tell us which product and version (or which web address), what you did, what happened, and what you think someone could do with it. Steps we can follow ourselves are worth more than a long write-up.

Email is not encrypted end to end. If the details are sensitive, say so in a first short message and we will agree a safer way to send them.

The same contact is published in machine-readable form at /.well-known/security.txt.

• Our desktop apps: Privatta, DuplicateDuster, VoiceMe, Stream ReRuns, the Markdown Reader & Editor, and the AssistantGeneral beta builds.
• This website, the account and licensing service behind it (api.royalsoftworks.com) and the download host (dl.royalsoftworks.com).
• The WebRTC Relay Server and the hosted copy Privatta uses, and SilverQR at silverqr.com.

Not covered: the services we buy from others — Paddle’s checkout, for example — which you should report to them; denial-of-service and load tests; and anything that relies on tricking our people or getting physical access to a machine.

1. You get a reply from a person within one business day, saying we have it.
2. We reproduce it and tell you whether we agree it is a problem, and how serious we think it is.
3. We fix it and ship the fix as an update. The released desktop apps check for new versions themselves, and each product’s changelog lists the fix under “Security”.
4. We tell you when the fix is out.

There is no paid bug bounty.

Test against your own copy, your own account and your own data. Do not read, change or delete anyone else’s, do not slow a service down for other people, and give us a reasonable chance to ship a fix before you publish. If you do that, we treat your report as help.

Our desktop apps do their work on your own computers, so what you keep in them never reaches us. What this site does hold — your account, your licences, what you write to us — is covered by our privacy policy (§9): if it is ever exposed, we follow a set procedure to contain it, tell the people affected, and notify the supervisory authority within 72 hours where the law requires it.

Outages of the account, licensing and checkout services are shown on the status page. For help with anything that is not a security problem, see Support.