Vulnerability Disclosure Policy

Last updated: 14 November 2026

I care about the security of the people using my plugins. If you find a vulnerability in a Halftone Audio plugin or on this website, please report it to me privately, so I can fix it before anyone exploits it.

In scope

• Halftone Audio plugins (Cloud Tape, Laundrolay, Halftone and later ones), as downloaded from this website.
• This website (halftone-audio.com).

Out of scope: third-party services (the hosting provider, your DAW), which should be reported to them directly; denial-of-service attacks; social engineering; copies of the software obtained from unofficial sources.

How to report

Write to hello@halftone-audio.com with the subject "Security" and include, if you can:

• product and version, operating system and DAW;
• a description of the issue and its possible impact;
• steps to reproduce it, and if useful an example project or preset file.

What I ask of you

• Do not make the issue public until it has been fixed, or in any case before 90 days from your report.
• Do not access or modify other people's data, and do not degrade the service for others.
• Act in good faith, only as far as needed to demonstrate the issue.

What you can expect

Halftone Audio is a personal project, so timelines are those of one person rather than a company, but:

• I will acknowledge your report within 14 days;
• I will keep you updated on verification and the fix;
• if you wish, I will thank you publicly in the release notes;
• I will not take legal action against anyone who reports in good faith and follows these rules.

There is no bug bounty: the plugins are free.

The security.txt file summarises these contacts in a standard format (RFC 9116). Report data is handled as described in the Privacy Policy.