Security and maintenance

Reporting a vulnerability

Send an email to hello@flosforge.eu with “Security” in the subject line. You can also find this address listed in this site’s security.txt. Please include:

• Which app and version you tested (found in the app’s About window or its store page);
• What you discovered, along with clear steps to reproduce the issue;
• The potential security impact or exploit scenario, as far as you can determine;
• Whether you would like to be publicly credited in the advisory, and under what name.

Please give me reasonable time to investigate and ship a fix before sharing details publicly. While I don’t offer a monetary bug bounty, what I do promise is a prompt, direct answer from the developer who wrote the code, and full credit in the published advisory if you'd like it.

What happens to a report

1. I will personally acknowledge your report within 5 working days.
2. I will verify the issue, assess its severity, and confirm the findings back to you.
3. I develop and release a patch, aiming for 90 days from confirmation at most—and significantly faster for high-severity issues or active threats.
4. Once the fix is live, I publish a security advisory detailing what was affected, which version resolves it, and any action you need to take. The app’s changelog links directly to this advisory.

If a vulnerability is ever found to be actively exploited in the wild, I will report it directly to the relevant cybersecurity authorities (including national CSIRTs and ENISA) and alert affected users immediately so they can protect their systems.

How long each app gets security fixes

Each commercial app receives guaranteed, free security updates for five years from its release date. The exact end date is set on launch day, displayed on the app’s changelog, and tracked in the table below. This commitment is focused strictly on security patches rather than endless feature additions or guarantees for every future OS upgrade—keeping it a clear, dependable promise that an independent developer can genuinely honour. Free, open-source projects do not carry a formal support SLA, but security reports for them are investigated with the same urgency.

How fixes reach you

Security updates are delivered the same way as regular software updates, and are always completely free. Mac App Store and Google Play apps are updated automatically by their respective stores. For desktop apps purchased directly from FlosForge, updates will be cryptographically signed and delivered securely over HTTPS, with full verification instructions documented here once direct sales go live.

How you are notified

• Public disclosure: Every advisory is published on the advisories page, distributed through the RSS feed, and linked in the changelog of each affected app.
• Direct purchases: If you bought directly from FlosForge, you’ll receive an email sent to the address used at checkout. That contact information is reserved strictly for critical security alerts, never marketing.
• Store purchases: If you bought through an app store, notifications appear directly in the release notes of the update that fixes the issue. App stores do not share customer emails with developers, so direct emails aren't possible.

No security advisory has been published for any FlosForge app.

If I cannot continue

FlosForge is run by a single developer, and the security support commitments on each app’s changelog will be honoured for as long as I am physically able to maintain them. If illness or unforeseen circumstances ever make it impossible for me to carry on supporting an app (or all of them), here is the concrete succession plan:

• Sales stop immediately: The affected apps will be removed from sale, recurring licences will stop renewing, and any unused portion of prepaid annual fees will be promptly refunded.
• Clear, early notification: A public notice will be posted on this page, on each affected app’s changelog, broadcast via the advisories feed, and emailed directly to registered customers. Relevant regulatory authorities will also be notified as required.
• Source code goes public: The app’s complete source code and full Git history will be released publicly on GitHub under an open-source licence, so users and the broader community can inspect, build, patch, and continue developing it.
• Your software keeps working: No FlosForge application depends on proprietary cloud servers or online licence verification to run. There is no remote kill switch or server to shut down.

This succession plan is prepared in advance: emergency instructions and repository access keys are held by a designated trustee, and every app repository is maintained clean, self-contained, and free of proprietary secrets so public release can be carried out smoothly even in my absence.

Privacy and the GDPR

FlosForge applications do not collect or transmit personal data: there are no user accounts, no telemetry frameworks, and no background crash reporting. Everything each application stores locally or connects to is documented in detail in its own privacy statement, linked directly from its product page. The GDPR applies to this website and any correspondence you send me, governed transparently across:

• The privacy policy: who the data controller is, minimal server logs, and how your statutory rights are respected;
• The cookie policy: essential cookies, optional analytics, and how to withdraw consent at any time;
• Application privacy overview: a unified, side-by-side summary of how every app handles your data.

Our approach to the EU Cyber Resilience Act

The European Union’s Cyber Resilience Act establishes a broad framework for software security, vulnerability handling, and product lifecycle support.

Rather than making formal legal compliance claims or treating security as a checkbox exercise, FlosForge embraces the practical engineering principles behind the regulation: clear and accessible vulnerability reporting, guaranteed security update periods for commercial software, public advisories with an open RSS feed, transparent changelogs, and local-first architectures that protect privacy by never collecting or storing personal data in the cloud.