Security
Security is about our software, not just yours
Security software that is itself insecure makes things worse. This page describes how qikfox products are built, updated and protected, and how to report a problem when you find one.
Engineering practices
Regular updates
Security fixes are delivered through the normal update channel rather than held for a feature release.
Isolation of untrusted content
Web pages and scanned files are handled separately from the rest of the application.
Least privilege
Components request only the access they need to do their job.
Dependency review
Third-party libraries are tracked and updated as security fixes are published.
Code review
Changes are reviewed before they ship, with additional review for security-sensitive areas.
Signed builds
Installers are signed so your operating system can verify they came from qikfox.
Account and operational security
Account protection
Sign-in supports strong authentication, and we notify you about changes to your account.
Encryption in transit
Traffic between our applications and our services is encrypted.
Access control
Internal access to production systems is limited and logged.
Incident response
A defined process for investigating, fixing and communicating about security incidents.
Reporting a vulnerability
If you have found a security issue in a qikfox product, we want to hear about it before anyone else does.
Our responsible disclosure policy describes what is in scope, what to include in a report and what to expect from us in response.
Advisories and updates for issues that have been fixed are published in the Security Center.
Security in depth
Security at qikfox covers two surfaces: the software itself, which must resist attack and update quickly, and your account, which must resist takeover. Both depend on unglamorous engineering practice - timely updates, least privilege, verified connections, careful handling of credentials - rather than on any single feature.
Updating quickly is the most valuable security feature
Most successful attacks on browsers and devices use a flaw that was already known and already fixed somewhere. The determining factor is how quickly the fix reaches the person. That makes update delivery a security feature rather than a maintenance detail, which is why qikfox products update automatically by default and why we do not encourage turning that off.
The corollary is that an old version of anything is the weakest part of a system. If you keep automatic updates on for one thing, make it the browser, since it processes untrusted content from the whole Internet all day.
Account security is mostly about the email account
Almost every account can be reset through email, which makes an email account the master key to a person's digital life. Securing it well - a long unique passphrase, an authenticator app or passkey, current recovery details - protects more than any other single action.
For qikfox accounts we support strong authentication and describe what account data exists and why. We do not ask for information we do not need to run the service, because data that is never collected cannot be lost.
- Give email a unique passphrase and a second factor first.
- Prefer an authenticator app or passkey over SMS codes.
- Store recovery codes somewhere not dependent on the account.
- Review connected applications and remove what you no longer use.
Disclosure is part of security, not a legal formality
Software has defects, including ours. What differentiates vendors is whether researchers can report them without friction and whether fixes ship promptly. Our responsible disclosure page states how to report, what to expect, and the safe-harbour commitment that applies to good-faith research.
We publish advisories and notices in the Security Center rather than only mentioning fixes in release notes, because a fix nobody hears about does not help anyone decide whether to update.
Frequently asked questions
Related qikfox pages
Security Center
Advisories and how to report an issue.
Trust Center
Practices, documentation and commitments.
Responsible disclosure
Scope, process and expectations.
Privacy at qikfox
What our products collect.
Found something? Tell us.
Security reports from researchers and users make the products better for everyone.