Security policy

If you have found a security problem in one of our apps, this website, or the update feed, we want to hear about it, and we will not make you regret reporting it.

How to report

E-mail security@finerthings.software. Include what you found, how to reproduce it, and what you think the impact is. Plain e-mail is fine; if you prefer to encrypt, ask for a key in your first message. A machine-readable version of this page is at /.well-known/security.txt (RFC 9116).

What we do

• We acknowledge your report within three business days.
• We tell you what we found and what we intend to do about it, and we keep you informed until it is fixed.
• We ask for 90 days from your report to publish a fix before details are made public — less if a fix ships sooner, more only by agreement.
• We credit you in the release notes if you want to be credited.
• We do not run a bug bounty. We say so here so nobody is surprised.

Scope

Finer Screenshot for macOS and any later Finer app, this website (finerthings.software), and the software update feed once it exists.

Good faith

We will not pursue legal action against anyone who reports in good faith: tests only against their own machines and data, does not disrupt the service for others, and gives us reasonable time to fix the problem before disclosing it.

Our own obligations

Once our software is on sale, we will report actively exploited vulnerabilities and severe incidents in it through the EU single reporting platform, which forwards them to Finland’s National Cyber Security Centre (Kyberturvallisuuskeskus), as the Cyber Resilience Act requires from 11 September 2026.