RigWave security
Protect the customer, protect the settings and fail safely.
Secrets stay secret
Passwords, stream keys and access tokens should not appear in normal logs, downloadable diagnostics or public website files.
Signed public builds
The public release is required to pass code-signing, timestamp, Windows Defender and release-integrity checks before the download is enabled.
Verified updates
Updates are intended to verify the expected RigWave publisher and signed update information before installation. If that verification fails, the update should be rejected rather than silently installed.
Safe failure
Where technically safe, a failed update or change should preserve or restore the last known-good settings, licence and customer state.
Protected internals
Some scoring, formulas and internal methods are deliberately hidden to protect original RigWave IP. That never means hiding a safety warning, consent choice or customer-visible change. You should still be told what RigWave found, what it wants to change, why it matters and what happened afterwards.
Customer-controlled diagnostics
Support uploads should be deliberate, previewable and redacted to the minimum useful information.
RESPONSIBLE VULNERABILITY REPORTING
Found a security weakness? Tell RigWave privately.
Private-beta reports: include the filename and published checksum shown with your download so support can identify the exact build. Never send activation codes, passwords, stream keys, tokens or payment-card data.
The staged security-reporting contact is info@rigwavesystems.co.uk. A controlled pre-launch round trip has proved that this mailbox can receive a report and send a manual reply. Keep reports bounded and never include activation codes, passwords, stream keys, access tokens, payment-card data or unrelated customer data. Automated acknowledgements, response-time targets and hosted availability remain separate operational checks.
- KEEP IT BOUNDED Do not use social testing, destructive tests, denial of service, persistence, credential theft or broad automated scanning against systems you are not authorised to test.
- PROTECT PEOPLE Stop if testing would expose or alter another person’s data. Minimise any data seen and report the issue without publishing secrets or personal information.
- NO IMPLIED PERMISSION This policy provides a reporting route and expectations. It does not grant permission to break the law, bypass third-party provider rules or access systems/data you are not entitled to access.
- WHAT RIGWAVE WILL DO A genuine report should be acknowledged, triaged and handled proportionately. Exact response times are not promised in this private test stage.
See the staged policy: Vulnerability Disclosure. A machine-readable /.well-known/security.txt contact is prepared in this staged package using the same verified mailbox. Hosted HTTPS retrieval, final expiry freshness and public deployment still require separate pre-launch verification.
RIGWAVE RELEASE SECURITY CHECK
Protect the RigWave file, not pretend to clean the whole PC.
RigWave is not antivirus, malware-removal software, a registry cleaner or a generic Windows optimiser. Its security job is narrower: protect the RigWave release, verify the exact file the customer received, respect the security product already protecting Windows and fail safely if trust cannot be established.
- SCAN THE EXACT RELEASE Use Microsoft Defender Antivirus / Windows Security where available to scan the exact release file. Record the file checksum, scan time and result so the public download can be matched to the checked file.
- VERIFY THE FILE Publish a checksum for each release file. Once signing is in place, verify the RigWave publisher/signature too. A mismatch or invalid signature is a stop condition.
- RESPECT WINDOWS SECURITY Never make “turn off Defender”, “disable SmartScreen” or “add a broad exclusion” the normal install path. A new legitimate app can still receive an unrecognised-app warning while reputation develops.
- NO SECURITY THEATRE Say what was actually checked: for example “No threats detected by Microsoft Defender in this RigWave file at the recorded scan time.” Never promise “virus-free”, “100% safe” or immunity from future threats.
- NO GENERIC CLEANING Do not scan or quarantine unrelated customer files, clean the registry, delete junk, disable security software or roam across the PC looking for problems outside the supported streaming chain.
- NO SILENT PUBLIC UPLOADS Do not automatically upload proprietary RigWave binaries, source, customer logs or customer files to public multi-engine analysis services. Any external sample submission needs an explicit IP/privacy/retention decision.
This is defence in depth, not an antivirus feature. Real Windows testing, code signing and Windows security/reputation checks still have to pass before public download is enabled.