Security

Your list stays on your computer.

How the desktop app protects your data, how license keys are signed, how payments are handled, and how to report a problem.

The desktop app

Local by design

  • Local only

    The engine listens only on your own computer, requires a fresh session token every launch, and rejects requests from any other page.

  • Nothing is ever sent

    The prober has no code path for sending mail; every conversation ends before a message could start.

  • Passwords stay in memory

    A relay password is never written to disk, and logins travel only over TLS (except to a mail server on this same computer).

  • No internal targets

    Private, loopback and link-local addresses are refused as probe targets unless you choose this computer’s own mail server.

  • Isolated window

    The app runs in its own browser profile and never touches your browsing session.

  • Honest about doubt

    Timeouts, refusals and blocked ports are reported as unknown or not checked, never passed off as a verdict.

  • Safe exports

    CSV cells that start with =, +, - or @ are neutralised, so a hostile address cannot become a spreadsheet formula.

  • Probing stays polite

    SMTP probing is off by default, limited to an allow-list of domains, spaced out per domain, and never goes past the recipient check.

  • The probe server keeps nothing

    Mailbox checks you run on the Dpunk probe server travel over HTTPS, need your licence key, and only reach mail servers. Addresses are deleted within an hour, and its logs hold counts, never addresses.

Licensing

Signed keys, checked offline

Every license key is a small signed document (DPUNK1.…) carrying your plan, expiry date and Machine ID, signed with an Ed25519 private key that never leaves the seller’s control. The app contains only the public key, so keys cannot be forged from the EXE, and a pasted key activates without an internet connection. Clock rollback is detected.

Daily license check-in. While a license from this website is active, the app checks in once a day when it is online. It sends only the license ID, the Machine ID and the app version, over HTTPS. The answer (active, renewed, moved or expired, plus the newest version number) is signed with the same Ed25519 key, and the app ignores any answer whose signature does not verify. Your email lists never leave your PC, and a failed check-in changes nothing. When you sign in inside the app, your password travels over HTTPS and is never stored.

This website

Built to hold as little as possible

  • Payments are handled by Cryptomus on their own payment page; we never see wallet keys.
  • Payment notifications are accepted only with a valid signature.
  • Passwords are stored as one-way hashes; the signing key and API secrets are encrypted at rest.
  • Every form is protected against cross-site request forgery, sign-in is rate-limited, and the admin area supports two-factor authentication.
  • A strict content security policy: scripts load only from this site.

Report a vulnerability

If you think you have found a security issue in the app or this website, please tell us privately first so we can fix it before it is disclosed. Include the steps to reproduce it and what you think the impact is. Please do not access other people’s data, disrupt the service or run automated scans against it.

Email support@dpunkmade.com with “Security report” in the subject. Dpunk Made will acknowledge your report and keep you updated.

Email a security report