Security
Report a vulnerability
Write to security@cphhvacstudio.dk. In a program, Help → Report a vulnerability… opens this page. Our contact for security reports is also in security.txt.
Please tell us:
- the program and its version;
- what you found and how to reproduce it;
- what an attacker could do with it.
What we do:
- We confirm within 7 days that we have received your report, and we keep you informed until it is fixed.
- We fix a confirmed vulnerability in a new version of the program — fixes come only in the latest version, for Free and Pro alike — and publish a notice in the program's release notes, under "Security".
- We report an actively exploited vulnerability and a severe incident to the authorities, as the EU Cyber Resilience Act requires.
- If you wish, we name you in the notice.
We follow coordinated disclosure: please give us reasonable time to fix a vulnerability before you make it public, and we agree the date of publication with you. Do not access other people's data or accounts, and do not disrupt our services.
Security updates
Each program gets security updates for at least 5 years from its placing on the market — its first release with Pro on sale; the free Revit plugin, from its first public release. Fixes come only in the latest version: as Free for everyone, and with Pro while your licence is valid. Each security update stays available for at least 10 years after its release.
| Program | On the market since | Security updates |
|---|---|---|
| Air Process Designer | Coming soon | for at least 5 years from the first release |
Checksums of the installers
With each release, we publish here the SHA-256 checksums of both installers, Free and Pro, from our archive of releases. Before a program installs an update, it checks the update's checksum itself.