SECURITY / REPORTING A VULNERABILITY

Found something? Tell us.

Reporting a security problem

If you find a vulnerability in Soundbox, its website or its activation service, please email Soundbox.support.qd@gmail.com with a description, the Soundbox version, and steps to reproduce.

• We acknowledge reports within 5 business days and keep you informed.
• Please give us 90 days to release a fix before publishing details, and don’t access other people’s data, degrade the service, or use social engineering.
• We will not take legal action against good-faith research that follows these rules, including research on the license protection, as long as you do not publish keys, cracks or bypasses.
• We credit researchers in the release notes if they wish.

Security updates

We publish security fixes for each supported version line until January 12, 2030. Soundbox checks for updates and installs only updates signed by us whose size and checksum match the signed release information; Windows also checks the publisher’s code signature before the new version starts. See Updates for how this works.

What protects you today

• The Windows app is digitally signed. Check the publisher in the file’s Properties → Digital Signatures before running it, and compare the SHA-256 checksum on the download page.
• The app runs its interface sandboxed under a strict content security policy, and refuses to start if its files were changed.
• License activation uses signed requests and signed answers over encrypted connections; the server stores hashes, not keys or addresses (details).
• This website loads nothing from other sites and sets no cookies.