PDF Textfix Download

PDF Textfix security and disclosure policy

Version 1.2, effective

Pocket Implementation S.R.L. makes PDF Textfix. If you find a security problem in the app or in this website, we want to hear about it, fix it, and tell the people who use PDF Textfix what changed.

How to report a problem

Write to contact@pocketimplementation.com with “Security report” as the subject. Please include:

  • the version of PDF Textfix (PDF Textfix > About PDF Textfix shows “Version 1.0.0” and the build number), whether it came from the Mac App Store or from pdftextfix.com, and the version of macOS;
  • what an attacker can do, and the steps to reproduce it;
  • when a file triggers the problem, a file you made for the purpose. Never send a document that holds someone’s personal or confidential data.

The same address is in /.well-known/security.txt. We read reports in English.

What to expect from us

  • We confirm that we received your report within 3 business days.
  • We tell you within 10 business days whether we can reproduce the problem and what we plan to do.
  • We keep you informed until the fix ships, and we credit you in the release notes if you wish.
  • We ask you to keep the problem private until a fixed version is available, or for 90 days from your report, whichever comes first. If a fix needs longer, we explain why and agree a date with you.

contact@pocketimplementation.com, with “Security report” as the subject, is the single point of contact for reporting vulnerabilities in PDF Textfix that the EU Cyber Resilience Act asks every manufacturer to name. Where the Act requires it, we also notify an actively exploited vulnerability or a severe incident to the Romanian national computer security incident response team, the Directoratul Național de Securitate Cibernetică (DNSC), and to ENISA through ENISA’s single reporting platform: an early warning within 24 hours, a notification within 72 hours and a final report, and we tell the people who use PDF Textfix what to do.

How PDF Textfix protects you

  • No account and no usage analytics. Neither version has an account or sends any record of how you use it; the documents you open never leave your Mac.
  • Sandboxed. Both versions run in the macOS App Sandbox and can open only the files you choose. The version from the Mac App Store goes online only when you buy or restore the purchase, to confirm it with RevenueCat and, until you quit the app, a few times more to keep that confirmation current, and sends nothing about your documents.
  • Connections only for updates and the licence. The version from pdftextfix.com checks for updates only when you allow it: the check runs in Sparkle’s separate downloader service, asks before its first automatic check, and is one HTTPS request to pdftextfix.com. With a licence, the app itself also connects, over HTTPS and only to our licence service, to activate the licence on the Mac and to check it about once a week; it accepts only answers signed with our key. The privacy policy describes both.
  • Signed updates. That version installs an update only when the archive carries a valid signature made with our update-signing key, whose public half is built into the app.
  • Signed and notarized. The app and the disk image on the download page are signed with our Apple Developer ID (team Q479N53SQD), use the hardened runtime and are notarized by Apple, so macOS checks them before the first launch. The download page lists the SHA-256 digest of every file of a release.

What is in scope

  • PDF Textfix for Mac, both the version from the Mac App Store and the version from pdftextfix.com: opening, editing and saving PDF files, the licence check and activation of the version from pdftextfix.com, and its update check.
  • The licence service at api.pdftextfix.com, which issues, activates and checks licences.
  • The update feed at pdftextfix.com/updates and the files offered for download on pdftextfix.com.
  • The website pdftextfix.com.

Not in scope: the checkout, which Paddle runs (report problems there to Paddle); the Mac App Store and its in-app purchase, which Apple runs; denial of service by sheer traffic; social engineering of our staff; and reports produced by automated scanners without a demonstrated impact.

Safe harbor

We will not take legal action against you, or ask anyone else to, for security research that follows every rule below:

  • You act in good faith, to find a problem and report it to us, not to harm anyone or to gain from it.
  • You test only your own copy of the app and your own files, and on the website you go no further than you need to show the problem.
  • You do not access, copy, keep, change or delete data that is not yours, beyond the least you need to show the problem. If you come across someone else’s data, you stop, tell us, and delete what you hold.
  • You do not run denial-of-service or load tests, or automated scans that slow the website or the update feed for others, and you do not send spam, phishing or social engineering to our staff or to people who use PDF Textfix.
  • You do not publish licences, a key generator or a way to work around the licence check or the watermark; a report that shows how to do it comes to us privately.
  • You do not test systems that others run, such as Paddle’s checkout, Apple’s App Store or our hosting provider; their own policies apply to them.
  • You give us reasonable time to fix the problem before you disclose it, as “What to expect from us” describes, and you do not ask for payment as a condition of keeping it private.
  • You comply with the law.

Research that follows these rules is authorised by us, as far as we can authorise it. This covers our own claims only: we cannot speak for Paddle, Apple, our hosting provider or anyone else. Research that breaks a rule is not covered. If you are unsure whether something is allowed, ask us first at the address above.

No rewards

We do not run a paid bug bounty. A report does not entitle you to payment, we do not pay to keep a problem private, and this policy is not a contract. If you wish, we credit you in the release notes.

How long PDF Textfix receives security fixes

Version 1.x of PDF Textfix receives security fixes for at least five years from the release of 1.0.0; its release notes give that day once it has shipped. A fix ships as a new 1.x version: through the App Store for the Mac App Store version, and through Help > Check for Updates… and the download page for the version from pdftextfix.com. The releases page lists every version.

PDF Textfix includes other software, such as qpdf and libjpeg-turbo, and, in the version from pdftextfix.com, Sparkle. We follow their security advisories and ship a fixed version of PDF Textfix when one of them affects it.

Contact

Pocket Implementation S.R.L., Bucharest, Romania (about the company). Security reports and everything else: contact@pocketimplementation.com; put “Security report” in the subject of a report. The registered seat and the register numbers are in the legal notice.