Security & Disclosure

Reporting a vulnerability

Email support@dfacto.ai with "security" in the subject. We acknowledge within 2 business days and will tell you honestly whether and when we can fix it.

Please give us reasonable time before publishing. We will credit you unless you would rather we did not. We do not currently run a paid bounty.

How licensing is designed

Licence tokens are Ed25519-signed and verified offline against a public key compiled into the application. The private key exists only on the issuing machine.

A token cannot be forged without that private key. A token can be copied between machines — an offline-verifiable licence is inherently copyable, and we would rather state that plainly than pretend otherwise. Device limits are enforced by policy, not by the token.

The signature is checked before the payload is parsed, so malformed input never reaches a JSON decoder as trusted data.

What the app can and cannot touch

The application is not sandboxed, because setting display modes and speaking DDC over the video cable are not operations available to a sandboxed process. It is ad-hoc signed and its complete source is public.

It only ever selects modes the display itself reports as supported, and it refuses to write an EDID override for a panel already driving all of its physical pixels.

This site

The site is static, has no database and no user accounts. The only dynamic endpoint is the licensing webhook, which verifies a per-provider signature before it will act on a payload. Report anything unexpected to support@dfacto.ai.