Security

Reporting a vulnerability

Write to info@uvinta.com with “Security” in the subject. Please include the Uvinta and macOS versions, what is affected and what an attacker could do, the steps to reproduce it, and whether it is already exploited or public. Please give us time to fix it before you publish: until a fix is released or 90 days have passed, whichever comes first.

What happens next

• We confirm receipt within 5 working days and tell you within 14 days whether we can reproduce it and how severe we consider it.
• A fix is released as soon as possible, as a security update separate from new features where feasible.
• We credit you in the release notes unless you prefer not to be named.
• An actively exploited vulnerability is reported to the national CSIRT and ENISA as the EU Cyber Resilience Act requires, and users are told in the update notice the app shows and in the release notes.

Updates and support period

Uvinta checks this site once a day for a newer version and tells you when one is there; security updates are marked as such and are free for every license, whatever its update period, and a subscription includes every update while it runs. We provide them for at least two years after the day your license key was issued, as updates to the latest release; a version first released on or after 11 December 2027 gets them for at least five years after its release. From the first release on or after 11 December 2027 the date support ends is published with each release.

How Uvinta is built to be safe

• No telemetry. The app connects only to this site (the update check, activation, your account if you sign in, and with a subscription its model), and to Hugging Face and the Python Package Index when you download a model.
• Every downloaded model and package is pinned to a version and checked against its SHA-256 before use.
• The local model servers listen on this Mac only and answer only the app, by a random key.
• The license key, the subscription's token and pass and the session of your account are kept in the macOS keychain. Password fields are never read.
• Settings → Appearance → Uvinta data deletes everything the app keeps on the Mac.