Security

How we protect Keylime accounts, licensing traffic, and seller data.

What we protect

Keylime sits between your paid software and the people who redeem keys. That means dashboard accounts, API traffic, license state, HWID binds, sessions, and the files or webhooks you attach to an app all need to stay under control.

We design the Service so critical decisions happen on our servers. A modified client can lie about local checks; it cannot invent a valid license, clear a ban, or mint keys without your credentials.

How Keylime is built

Encrypted in transit

Dashboard and API traffic use TLS. Requests that manage licenses and sessions are authenticated so stray clients cannot call privileged endpoints as you.

Credentials stay hashed

Seller passwords are stored hashed, not in plain text. Session cookies and API keys are treated as secrets. Rotate keys if a machine or teammate machine is compromised.

Server-side enforcement

License validity, HWID locks, bans, quotas, and reseller balances are decided by Keylime. Client SDKs help your app check in; they do not replace server validation.

Account and dashboard access

Seller dashboards use cookie sessions and additional request signing where enabled. Optional captcha and device signals help block automated login abuse. We recommend unique passwords and treating reseller seat logins as production credentials.

Team invites and elevated roles should be limited to people you trust. Remove seats when partners leave. Never embed your developer API key in a public client binary.

Licensing abuse controls

Sellers can reduce sharing and cracks with controls built into each app:

  • HWID lock after first activation, with manual resets when a buyer changes machines.
  • Session list and revoke for live clients that should no longer run.
  • Key ban and user ban when a license is leaked or misused.
  • Named subscription types so minting stays intentional about what you sell.
  • Reseller seats with mint balances instead of handing out your operator keys.

These tools slow casual sharing and give you operational leverage. They are not a substitute for packing or obfuscating your own binaries if your threat model needs that.

Infrastructure and operations

Access to operator tools is limited. We log security-relevant events so we can investigate abuse, failed logins, and unusual mint activity.

Planned maintenance and major incidents are reflected on our Status page when they affect validation or the dashboard.

What sellers should do

  • Keep API keys on your backend or private build machines only.
  • Use HWID lock and session revoke for products that travel widely.
  • Review webhooks and download URLs so they do not leak secrets.
  • Reset HWID only after you verify a hardware change with the buyer.
  • Report suspected platform issues early so we can contain them.

Vulnerability disclosure

If you find a security issue in Keylime, tell us privately before publishing details. We take reports that affect account takeover, license bypass across tenants, or unauthorized minting seriously.

Reporting process:

  • Email security@keylime.cc with clear steps to reproduce.
  • Include impact, affected surfaces, and any relevant request samples.
  • Give us a reasonable window to verify and fix before public disclosure.
  • Do not probe other customers' data, disrupt service availability, or use findings for anything beyond coordinated disclosure.

We will acknowledge valid reports and work with you on timing once a fix is ready. For privacy questions, see our Privacy Policy.