TrickTic Dictate Security Policy

Last updated: September 24, 2026

This page explains how to report a security vulnerability in TrickTic Dictate, and which versions receive security fixes. For how the app handles your data and which permissions it uses, see the privacy policy at https://tricktic.com/automation/legal/tricktic-dictate/privacy.

Reporting a vulnerability

Report suspected vulnerabilities privately by email. Do not post exploit details, keys, recordings or transcripts in public.

Security reports: report@tricktic.com

Please include:

the platform (Windows or Android), the app version and where you installed it from;
a short description of the impact;
minimal steps to reproduce it.

Use synthetic audio and invented text where you can. Remove API keys, personal paths and other people's data from attachments. If reproducing the problem would require sensitive material, describe it first and we will agree on a private way to transfer it. Email is not end-to-end encrypted.

What to expect

We acknowledge receipt, confirm the problem and its severity, and agree with you on follow-up and disclosure. This is a small project: there is no 24/7 response, no guaranteed response or fix time, no bug bounty and no legal safe-harbour programme. If you do not hear back, follow up on the same email thread.

Once a fix or workaround is available, we publish an advisory that names the affected and fixed versions and any action users need to take, and credit you if you wish. If no safe fix is ready, we publish a workaround or withdraw the affected release.

Testing rules

Test only installations and accounts you own or are explicitly authorised to test.
Do not probe the release and update servers, access other people's data, run up charges on another person's provider account, or disrupt a service.

Supported versions

Platform	Security fixes
Windows	The latest version from tricktic.com, delivered by the app's built-in updates
Android	The latest version on Google Play

Older versions are fixed by updating to the latest version; there are no separate fixes for older versions. Windows and Android can have different version numbers.

How updates are protected

The Windows installer is not signed with a Microsoft code-signing certificate, so Windows SmartScreen shows it as coming from an unknown publisher. The download page lists the installer's SHA-256 checksum so you can check the file. After installation, the app verifies every update against TrickTic Dictate's own update signing key before installing it.