One reporting route. One clear period.
Security and support
Report a vulnerability confidentially and see before purchase how long Solidon 1 receives security updates.
Solidon 1 is a paid perpetual-use licence
The purchase price includes every security and feature update within major version 1. I provide security support and security updates for Solidon 1.x until at least 31 October 2031.
The version you purchased remains usable without a time limit afterwards. The end of the security-support period ends neither the licence nor access to your projects.
The time-limited demo has a 0.x version number and ends on 30 October 2026. It is not the paid version 1.
What to include in a security report
- Solidon3D version and operating system,
- the behaviour observed and its possible security impact,
- reproducible steps or the smallest practical test case,
- if known: the affected file, feature or dependency.
Do not send: licence keys, complete project files or personal data. If the investigation needs more, I will ask specifically for the smallest necessary evidence.
What happens next
I acknowledge receipt within two business days, assess impact and scope, and keep you informed about mitigation and disclosure. I do not treat good-faith research and coordinated disclosure as an attack.
For a demonstrably actively exploited vulnerability or a severe security incident, RS Digital promptly checks which statutory reports and deadlines apply to the specific case. Your route stays the same: one message to support@solidon3d.de is enough.
Scope
This route covers official Solidon3D packages from this website, local project processing, activation, update checks and support submission. Third-party slicers, Ollama, ComfyUI and external AI providers are not bundled. Still report any weakness in their integration that Solidon3D triggers or amplifies.
Since 11 September 2026, Solidon has been subject to the reporting obligations in Article 14 of the Cyber Resilience Act (EU) 2024/2847. Actively exploited vulnerabilities and severe incidents affecting product security must be reported through the ENISA Single Reporting Platform to the competent coordinating CSIRT and simultaneously to ENISA. Operational readiness for this reporting process has not yet been fully demonstrated. This does not postpone statutory reporting deadlines or the duty to inform users. The application’s update notice and this page provide user information. The two-working-day response time for people reporting issues is not a deadline for notifying authorities.
Updated: 12 September 2026