We do not sell to your country. Why?

Irrvogel Interactive

Security

How to report a security problem, and how we protect your data and downloads.

Report a security problem

  • How to report

    Email security@irrvogel.com, in English or German. If you think the problem is already being used in attacks, write EXPLOITED in the subject line. You can also write by post to the address in the Impressum.

  • What to include

    The product and its version (or the web address), what you did and what happened, and how we can reproduce it.

  • What not to send

    License keys, passwords or other people’s data.

  • Before you publish

    Please give us time to fix the problem. We agree the publication date with you.

  • Please do not test our servers

    Report what you notice while using our software or website normally. Do not scan, attack or overload the license server or the website, and do not try other people’s keys or accounts. Unauthorized access to computer systems is a criminal offense in most countries.

The same contact details are also published in machine-readable form at /.well-known/security.txt (RFC 9116).

What happens after you report

  1. Day 0

    You report

    You email security@irrvogel.com.

  2. ≤ 5 working days

    We confirm

    You get a reply with a reference number.

  3. ≤ 10 working days

    We assess

    We tell you whether we can reproduce it and what we plan to do.

  4. As fast as we can

    We fix

    Security fixes are free for everyone with a valid license key or supporter key.

  5. ≤ 90 days

    We publish

    On a date agreed with you, usually when the fix is out. We credit you if you want.

If attackers are already exploiting a flaw, we report it to the Austrian CSIRT (CERT.at) and to ENISA, as EU law requires. We also tell users on this page and in the update notice inside the software.

Security updates

Each product version gets security updates until the end date on its product page, which is at least 5 years after its release. Security fixes go into the newest version. Updating is free for license and supporter key holders. Older versions stay available for download for at least 10 years, and you find them in the download section of each product page.

How your data is protected

  • Our server keeps only a fingerprint of each license key, so once your key email has been delivered, nobody can read your key on our server, including us.
  • Your email address is also stored as a fingerprint on the license server.
  • Link, a Stripe company, handles the payments, so your card details go to Link and never to us.
  • The software contacts our license server only to activate, deactivate and check the license.
  • Update checks go to updates.irrvogel.com and carry no license data.

More in the privacy policy.

Check your download

Every download lists a SHA-256 checksum. Run the command for your system on the file you downloaded and compare the result with the listed checksum.

Windows

Open PowerShell and run:

Get-FileHash .\ivi-midi-text-display-2026.1.1-windows-x64.zip

PowerShell prints the checksum in capital letters, and you can compare it in upper or lower case.

Linux

Open a terminal and run:

sha256sum ivi-midi-text-display-2026.1.1-linux-x64.tar.gz

If the two values differ, skip the installation and write to us.

Check the signature of the checksums

Each release page also has SHA256SUMS.txt, which lists the checksums of all files. Its signature is SHA256SUMS.txt.minisig, made with minisign. To check that the checksums come from us, save both files in one folder and run this command with our public key:

minisign -Vm SHA256SUMS.txt -P RWSxmY5haZM8KPjgPOyRzrtdgS0SuRhbIuYYD6TBDx19N/e4MmZNGpJ2

The same key is in the README of our releases repository on GitHub.

Security notices

We list security notices here when we publish one. There are none so far.

Security research

We don't run a bug bounty program and don't pay for reports, but we're grateful for every one and name you in the release notes if you want.