Reporting a vulnerability
If you think you have found a security vulnerability in AFKSecurity, please tell us privately first. We will work with you to fix it and to publish the fix before the details are made public.
How to report
Write to support@afksecurity.online. English or French. Please include the AFKSecurity version (shown under About), your Windows version, what you did, what happened, and how to reproduce it. A proof of concept helps; do not send real malware.
What is in scope
The AFKSecurity service and window, its installer, its update mechanism and the
signed update manifest, the licence server under afksecurity.online/api/,
and this website.
What we commit to
We acknowledge your report within 5 business days and give you a first assessment within 10 business days. We keep you informed until the fix ships, and we aim to publish a fix within 90 days, sooner for serious issues. When the fix is out, we describe the vulnerability in the changelog: what was affected, its severity, and what to do. With your agreement, we credit you by name.
Disclosure
Please give us 90 days, or until a fix is published if that comes first, before disclosing details. If a vulnerability is being actively exploited, we may publish a warning earlier, and we notify the authorities as the EU Cyber Resilience Act requires.
Good-faith research
We will not take legal action against research carried out in good faith within this policy. Please test only on your own computer and your own licence, do not access or change other people's data, do not degrade our servers, and do not use social engineering. There is no paid bug bounty.
Reporting to the Belgian authority
AFKSecurity is published in Belgium. You may also report a vulnerability to the Centre for Cybersecurity Belgium, which coordinates vulnerability disclosure: ccb.belgium.be.
How long security updates are provided
Every AFKSecurity 1.x version receives security updates, free of charge, until at least September 2031. Updates are delivered through the built-in update mechanism and on the download page. Security fixes are delivered even when your licence has expired.