Vulnerability disclosure policy

How to report

Send an email to the security address (see /.well-known/security.txt on this site). Please include:

• The affected product version or web page address;
• A description of the issue and steps to reproduce it;
• The scope of impact as you assess it;
• The name you would like used in the acknowledgment (optional).

Please do not attach files containing real personal information. If you need a sample file, use synthetic data.

What we commit to

• Confirm receipt within 3 business days;
• Give an initial assessment within 10 business days;
• Notify you after the fix and, with your consent, thank you in the changelog.

Scope

• The current version of the PDF Text Replacer Windows software;
• This website and its form endpoints;
• The integrity check mechanisms for installers and language packs.

Out of scope: vulnerabilities in third-party platforms themselves (such as AI translation providers), social engineering attacks, and attacks that require physical access to a device.

Safe harbor

We will not pursue legal action for security research carried out in good faith within the scope of this policy. Please avoid accessing, changing or deleting other people’s data, avoid affecting service availability, and do not publish details before a fix.