Security policy

Last updated 30 October 2026

Reporting a vulnerability

If you think you have found a security problem in Horario, email support@horario.io with “Security” in the subject line. Please report it to us privately and give us a chance to fix it before you share it with anyone else.

Scope

• The Horario desktop app and its update feed
• The Horario API, including licence activation, cloud sync and the payment webhook
• This website, www.horario.io

Our payment provider, Paddle.com, runs its own checkout and customer portal; please report problems there to Paddle directly.

What to include

• The version of Horario and the operating system you used
• The steps that reproduce the problem, and what an attacker could do
• Any proof of concept, logs or screenshots
• How you would like to be credited, if at all

What happens next

We confirm that we received your report within 3 business days and give you our assessment within 10 business days. We keep you updated while we work on a fix, aim to ship it within 90 days, and credit you when it is released if you want us to.

How fixes reach you

Fixes ship as a new version of Horario through its built-in updater, which only installs updates signed with our key. Fixes to the API and this website go live without any action on your part.

Safe harbour

We will not take legal action against anyone who researches and reports a vulnerability in good faith under this policy. That means you avoid harming our users or our service: you only access your own data or accounts you are allowed to use, you do not degrade the service or run denial-of-service tests, you stop and tell us as soon as you reach anyone else’s data, and you keep the details private until a fix has shipped.