How we secure Defendrix itself.
Defendrix protects computers, so the security of Defendrix itself has to hold up. Here's what we ship, what our threat model actually is, and how to report a vulnerability if you find one.
Who we're defending against.
Commodity malware
Trojans, downloaders, PUAs, drive-by drops. Real-time scanning, behavior heuristics, and reputation checks provide layered evidence and controls for these threats. They reduce routine noise so higher-confidence attack evidence can stand out.
Ransomware
The Ransomware Correlator joins entropy, decoy, and behavior evidence. When signals converge on the same exact process identity, Defendrix can suspend it and persist a Pending Review record before the consumer chooses resume or terminate.
Post-compromise attackers
The interesting attackers. Fileless techniques, LOLBin abuse, inline hooking, credential theft, lateral movement. The Fileless engine, Live Patch Guard, and Behavior Profiler exist for these.
Insider mistakes
USB media plugged into the wrong machine. A stray script. An admin clicking a phishing link. Execution Gate, USB scanning, and LAN protection provide evidence and controls for that accidental-attack surface without claiming universal prevention.
MITM on the LAN
Rogue DHCP, ARP poisoning, and DNS response spoofing produce LAN evidence. Authenticated peer observations can cross-check expected gateway mappings, while inconsistent or replayed network input is rejected rather than trusted.
Not in scope: nation-state 0-days
We're not going to catch a well-funded APT's custom 0-day chain in memory before it detonates. User-mode sensors can also be bypassed after kernel compromise. Protection Health reports degraded visibility instead of claiming otherwise.
Attackers try to kill the AV. We planned for that.
Process shield
Install ACLs, startup enforcement, tamper observation, and an authenticated watchdog raise the cost of disabling Defendrix and support recovery. They do not pretend a user-mode process is unkillable after administrator or kernel compromise.
Self-healing binaries
Integrity checks, the directory guard, startup enforcement, and the authenticated watchdog attempt recovery from validated local material. Protection Health reports degradation when an expected component or recovery step cannot be confirmed.
Tamper-evident logs
Security log entries are authenticated and continuity is checked where prior state is available. Corrupt or missing state surfaces degradation; the product does not claim that a user-mode log can survive arbitrary administrator or disk compromise.
Encrypted quarantine vault
Quarantined samples use authenticated encryption with key material protected by machine-scope DPAPI. Restore verifies the manifest and payload before committing a durable destination file; malformed or corrupt vault state fails closed.
Connected data is bounded and documented.
Basic activation and seat enforcement use:
- License, device, connection, and hardware-bound identifiers
- Canonical username, role, machine name, OS, and app version
- Activation, check-in, nonce, and offline-grace timestamps
If fleet synchronization is enabled, the configured service also receives bounded health, engine-state, settings-fingerprint, count, detection, login, coverage-gap, and audit summaries. Detection records can include a local path and SHA-256 alongside the threat label, verdict, and action. File contents and raw network packets stay local. Remote-support chat, clipboard, file transfer, process, command, and screen data move only during an explicitly approved session and remain separate from routine fleet sync.
The portal practices what the product preaches.
Hardened headers
Production responses use a Content Security Policy, HSTS, clickjacking protection through frame-ancestors, MIME-sniffing protection, and a strict referrer policy. These controls are validated during release checks and monitored for regressions.
Passwords are never stored in plaintext
Passwords are represented by memory-hard, uniquely salted verifiers protected by an independent server-side pepper; plaintext passwords are not retained. Email verification and recovery credentials are purpose-bound, single-use, and short-lived. Sessions use opaque, revocable, HTTP-only cookies rather than browser storage.
Signed webhooks, checked ownership
Payment webhooks verify Stripe and PayPal signatures before touching anything, and every dashboard action re-checks on the server that the key actually belongs to your account.
Rate limits + security.txt
Public forms and email-producing endpoints use distributed ingress and address limits, and /.well-known/security.txt tells researchers exactly where to submit a report.
Found a bug? Please tell us.
How to report
Use the security report form with a safe summary and as much non-sensitive detail as you can share. For encrypted follow-up, request a protected channel in the report before sharing secrets.
Please include: the version of Defendrix you tested (Settings → About), the OS (Windows 10 vs 11, build number), and steps to reproduce. Working PoC not required but very appreciated.
What we do
We confirm receipt as soon as practical, triage impact and reproducibility, and keep the reporter informed while remediation is prepared. Timing depends on severity, exploitability, and the safety of releasing details. We coordinate disclosure and credit reporters when they want attribution.
We do not currently operate a public bug-bounty program. Please avoid accessing other people's data, disrupting service, or testing beyond what is needed to demonstrate the issue safely. Ask us before work that could affect production.
See what's in each release.
The changelog records published security fixes, engine changes, and important configuration updates for each available build.