GridDown by BlackDot Technology

Last updated: January 2025

BlackDot Technology takes security seriously. GridDown is designed with a security-first mindset:

• Offline-first architecture minimizes attack surface
• No user accounts means no credentials to steal
• Local data storage keeps your information on your device
• No cloud backend eliminates server-side vulnerabilities
• Open source enables community security review

We provide security updates for the following versions:

Recommendation: Always use the latest version for the best security.

If you discover a security vulnerability in GridDown, please report it responsibly:

Email: security@blackdot.tech

Include in your report:

1. Description of the vulnerability
2. Steps to reproduce
3. Potential impact assessment
4. Any proof-of-concept code (if applicable)
5. Your suggested fix (optional but appreciated)

PGP Key (optional): Available at https://blackdot.tech/.well-known/security.txt

• ❌ Do not publicly disclose the vulnerability before we've addressed it
• ❌ Do not exploit the vulnerability beyond what's necessary to demonstrate it
• ❌ Do not access, modify, or delete other users' data
• ❌ Do not perform denial of service attacks

We support responsible security research. If you:

• Act in good faith
• Avoid privacy violations
• Avoid data destruction
• Report vulnerabilities promptly
• Allow reasonable time for fixes

We will:

• ✅ Not pursue legal action against you
• ✅ Work with you to understand and resolve the issue
• ✅ Credit you in security advisories (if desired)
• ✅ Keep you informed of our progress

The following are within the scope of our security policy:

The following are outside our security scope:

GridDown does not transmit any data to BlackDot Technology servers. We have:

• No analytics
• No telemetry
• No crash reporting
• No user accounts
• No cloud sync
• No backend servers

• Risk: Browser storage can be cleared by user or browser
• Mitigation: Regular data export recommended
• User Action: Export important data periodically

• Risk: Map tiles and weather data come from external sources
• Mitigation: Use HTTPS, validate responses
• User Action: Verify critical data through official sources

• Risk: Malicious devices could send unexpected data
• Mitigation: Input validation, connection to known devices only
• User Action: Only connect trusted devices

• Risk: Cached tiles could theoretically be tampered with
• Mitigation: Tiles from HTTPS sources, browser cache isolation
• User Action: Re-download tiles if integrity is questionable

• Risk: Installing PWA grants offline capability
• Mitigation: Service worker validates cached resources
• User Action: Install only from trusted sources

• Risk: Weak passphrase could be brute-forced
• Mitigation: AES-256-GCM encryption, PBKDF2 key derivation
• User Action: Use strong passphrases for sensitive plans

1. Keep GridDown updated - Install new versions promptly
2. Use HTTPS - Always access GridDown via HTTPS
3. Secure your device - Use screen lock, encryption
4. Regular exports - Backup important data

1. Verify GPS accuracy - Cross-check critical positions
2. Use strong passphrases - For encrypted plan exports
3. Clear data when needed - Browser settings → Clear site data
4. Audit permissions - Review granted device permissions

1. Trust your devices - Only connect known hardware
2. Secure your network - For RF Sentinel WebSocket connections
3. Physical security - Protect connected devices

Security updates are distributed through:

1. Version updates - Install latest version
2. Service worker - Automatic background updates
3. Security advisories - Posted in CHANGELOG.md
4. Critical alerts - Email to registered contacts (if opted in)

To verify you have an authentic GridDown release:

1. Download only from official sources
2. Check version number in Settings → About
3. Verify service worker version matches release

We will document disclosed vulnerabilities here after fixes are released.

We do not currently offer a paid bug bounty program. However, we:

• ✅ Acknowledge security researchers in release notes
• ✅ Provide letters of appreciation for significant findings
• ✅ May offer GridDown merchandise for exceptional reports

Email: security@blackdot.tech

Response Time: Within 48 hours

Encryption: PGP key available at https://blackdot.tech/.well-known/security.txt

Alternative Contact: legal@blackdot.tech (if security@ is unresponsive)

• Privacy Policy - Data handling practices
• Terms of Service - Usage terms
• Disclaimer - Safety information
• License - Software licensing

Thank you for helping keep GridDown secure!

© 2025 BlackDot Technology. All Rights Reserved.