Stereosonic Labs

Security

Found a security problem in Stereosonic MIX or one of our web services? Tell us, and we will fix it. This page explains how to report it and what we promise in return.

How to report

Email security@stereosoniclabs.com with ‘Security’ in the subject. Please include:

  • what the problem is and where you found it
  • the steps to reproduce it, or a proof of concept
  • the MIX version and macOS version, if it concerns the app
  • what an attacker could do with it

Write in English or Norwegian. Please don’t report security problems through the support form or in public, such as on social media.

What is covered

This policy covers:

  • Stereosonic MIX for macOS, including the updater and licence activation
  • stereosoniclabs.com and its forms
  • downloads.stereosoniclabs.com, where the app and its updates live
  • the services MIX talks to, such as the licence server and the update check

Problems in the services we use, such as Stripe, Loops, Netlify, or Cloudflare, belong with them. If you think the way we use one of them is the problem, tell us.

What we promise

When you report a problem in good faith, we will:

  • confirm that we have received it within five working days
  • tell you whether we can reproduce it, and keep you posted while we fix it
  • let you know when the fix is out
  • thank you by name in the release notes, if you want us to

We have no bug bounty programme, so we can’t pay for reports.

What we ask of you

Please:

  • give us a reasonable time to fix the problem before you publish anything. We suggest 90 days, and we will agree on a date with you.
  • only use your own accounts, licences, and data. If you come across other people’s data, stop, don’t keep it, and tell us.
  • not disrupt our services, for example by load testing or denial of service
  • not use social engineering, phishing, or spam against us or our users

Safe harbour

If you follow this policy, we consider your research authorised. We will not take legal action against you or report you to the police for it. If someone else makes a complaint about your research, we will make it clear that you acted under this policy.

Machine-readable version

The same contact details are in /.well-known/security.txt, following RFC 9116.