Security Policy

Reporting a Vulnerability

If you believe you have found a security vulnerability in the NTLite software or in ntlite.com services, email [email protected]. Please do not post security issues on the public forum or social media before a fix is available.

Include what you can of the following: the software version or URL affected, steps to reproduce, the impact you believe it has, and any proof-of-concept material. If email does not work for you, the contact form works as well - mention that it concerns security so it gets routed correctly.

What to Expect

We aim to acknowledge your report within 7 days and will keep you informed as we validate and address the issue. Confirmed vulnerabilities are fixed with priority, and security fixes are released as soon as they are ready rather than waiting for a feature release.

If you would like credit for the discovery, tell us how you want to be named and we will include it in the release notes for the fix. If you prefer to stay anonymous, that is fine too.

Coordinated Disclosure

We ask that you keep the details of a report private until a fixed version is available to users. In return, we work with you on a disclosure timeline, and once a fix has shipped we publish information about the vulnerability - a description, the affected versions, its severity, and how to remediate - in the changelog.

Good-Faith Research

We will not pursue legal action against researchers who report vulnerabilities in good faith: testing done without harming users or data, without degrading our services, and without accessing data that is not yours. Automated scanning that disrupts services, spam, social engineering of our staff or users, and physical attacks are outside the scope of this policy.

Scope

In scope: the NTLite software (all versions and channels), its update mechanism, and the ntlite.com website and services. Out of scope: vulnerabilities in Windows itself or other Microsoft components NTLite operates on (report those to Microsoft), and issues in third-party services we use, such as the payment processor (report those to the vendor).

How NTLite Handles Security

NTLite is a local desktop tool. It reads a Windows installation image, or the system it runs on, and writes back the changes you configure. Servicing an image requires administrator rights, so the program always runs elevated.

• No background service, no listening network ports, no user account, and no telemetry. Nothing runs when the program is closed.
• Network traffic happens only on your action or on the update check: the version check and update download from ntlite.com, license activation against our licensing server, and downloads of Windows updates, drivers and app packages from their own vendors when you ask for them. All over HTTPS.
• Nothing about the host system is changed by installing NTLite. Every removal, tweak and setting is applied only where you point it, and only what you select.
• The license file stored next to the program holds your license key and a machine identifier. It contains no password and no payment data.
• All released binaries are digitally signed, and the built-in updater verifies that signature before an update is allowed to run.

Using NTLite Safely

A few situations deserve attention, because they can weaken security in ways that are easy to miss:

• Use images and packages you trust. Image files, update packages and driver archives are parsed by an elevated process. A deliberately corrupted file from an unknown source carries the same kind of risk as opening any untrusted file with an administrative tool. Prefer Microsoft originals and vendor downloads.
• Know what a preset turns off. Removing Defender, Windows Update, the firewall or related components leaves the Windows you build less protected than a stock installation. That is a legitimate choice for an isolated or offline machine, and a poor one for a daily driver.
• Unattended answers can contain credentials. An auto-logon password entered for unattended setup ends up inside the image and the preset. Treat both as sensitive and do not share them.
• On a shared computer, install rather than run portable. A portable copy in a folder you can write to can be modified by anything else running as you, and the program runs with administrator rights. The installed version lives in a location only administrators can write to.

Getting Security Updates

Security fixes are delivered as a normal program update. Use the Menu button and select Check for updates, or download the current version from the download page and install it over the existing one. Settings and presets are preserved.

Downloads are served over HTTPS and every installer is digitally signed. The built-in updater verifies the signature of a downloaded update before installing it and refuses files that fail verification. If the software ever reports an update signature problem, do not run the file manually - report it to [email protected].