UNITAR STRUCT / INFORMATION
Security and vulnerability reporting
Updated 28 October 2026 ·
How to report a security problem in UNITAR STRUCT, how long the software receives security updates and how updates and the license are protected. The contractual rules are in the Terms, Sections 16 and 17.
1. Reporting a vulnerability
Write to office@unitarsoft.com with the subject «Security». It is the single point of contact for vulnerabilities. Tell us the software version (shown by UNITAR_LICENSE or in the command line at start-up), the CAD application and the operating system, the steps that reproduce the problem and its effect. Do not send your license key, passwords or your clients' projects; if a file is needed, we will ask for a test file. We acknowledge receipt, usually within 5 business days, and keep you informed until the fix. You can write in English or Romanian.
2. Coordinated disclosure
Please do not publish the details until the fix or, if the fix is delayed, for 90 days after your report, and do not access, change or delete other people's data. If you wish, we credit you in the notes of the version that contains the fix. Test only on your own installation and with your own license; do not test the unitar.net servers by excessive load or by attempts to reach other customers' data.
3. How long you receive security updates
Security updates are provided at least for the duration of the active subscription (Terms Section 16(6)), for the latest stable version. You install them with UNITAR_UPDATE; the new version becomes active the next time the CAD application starts. For security, compatibility or maintenance we may set a minimum version, which we announce in advance (Section 16(5)). The beta channel receives fixes earlier but is not recommended for projects that require full stability.
4. How the software and the license are protected
The software checks every update package before installing it, by its SHA-256 sum and an RSA digital signature of UNITAR SOFT; a modified package is refused, whatever server it was downloaded from. The Windows installer is digitally signed (Azure Artifact Signing), and the Downloads page shows the SHA-256 sum of every kit. Activation, license validation and update checks go over HTTPS. The license server keeps only the SHA-256 fingerprint of the key, not the key. The software sends no drawings or project data and needs no administrator rights to install.
5. Informing users
When we fix a vulnerability that may affect users, the version notes say what was fixed and what to do, and for serious problems we also email customers with an active subscription. From 11 September 2026, actively exploited vulnerabilities and severe incidents affecting the security of the software are notified to the authorities, under Regulation (EU) 2024/2847 on horizontal cybersecurity requirements (Cyber Resilience Act).
6. What you can do
Download the kit only from unitar.net/download and check its SHA-256 sum. Install updates while your subscription is active. Do not publish or send your license key; if you have lost control of it, write to us. We never ask for your password, your card details or for you to install a program received by email: such a message that seems to come from us is a fraud attempt, and reporting it helps us.
7. The manufacturer
UNITAR SOFT S.R.L., Romanian tax identification number (CUI): 54974076, Trade Register number: J2026040619004. Registered office: București Sectorul 3, Strada Dristorului, Nr. 98, CAMERA NR. 2, Bl. 11, Scara B, Etaj 10, Ap. 85, România. Email: office@unitarsoft.com. Phone: +40 748 237 322, Monday–Friday, 9:00–17:00 (Romanian time) — for vulnerabilities we prefer email, so that the description stays in writing.