Maniac Lab
ΕΛ Download

Security

Last updated: 27 October 2026

Security matters to us — in Maniac OS, in the apps and in the services behind them. This page explains how we protect your account and data, and how to tell us about a vulnerability.

How we protect you

  • No passwords to leak. You sign in to your Maniac ID with a 6-digit code sent by e-mail. A code is valid for 10 minutes, and attempts are limited.
  • Per-PC sessions. Each PC has its own sign-in, which ends when you deauthorise that PC.
  • Signed licences and apps. App licences are cryptographically signed for one PC, and apps come as signed, encrypted .mapp files that run only on Maniac OS, on the PC they were installed on.
  • Payments elsewhere. Payments are processed by Lemon Squeezy; we never see your card details.
  • Encrypted connections. This site and our licence server (https://store.maniaclab.app) are only served over HTTPS.
  • Secure Boot. Maniac OS starts with a signed boot loader and kernel.
  • Clinic. Patient data is kept in an encrypted database on the practice’s PC, with user roles and a tamper-evident audit log.

Reporting a vulnerability

If you think you’ve found a security problem in Maniac OS, one of our apps, this website, the download server or the licence server, please write to support@maniaclab.app with “Security” in the subject. Please include:

  • a description of the problem and its possible impact;
  • the steps to reproduce it, and the version or address affected;
  • how we can reach you, and whether you’d like to be credited.

We will acknowledge your report, keep you informed while we work on it, and credit you when it’s fixed if you wish. Please give us reasonable time to fix the problem before you make it public.

Please don’t

  • access, change or delete other people’s data or accounts — use only accounts and PCs of your own;
  • degrade our services, for example by denial-of-service attacks or automated mass requests;
  • use social engineering, phishing or physical attacks;
  • make a problem public before it has been fixed.

If you act in good faith and follow these rules, we will not take legal action against you for your research.

Problems in Lemon Squeezy’s checkout or in Cloudflare’s services should be reported to those companies. We don’t run a paid bug bounty.