Support and security updates
Effective date: 2026-10-20
Manufacturer and contact
Vettalon Pro and Vettalon Team are developed and sold by Dudu Technology Ltd. (嘟嘟數位科技有限公司), a company incorporated in Taiwan, Unified Business Number 94139082.
Postal address: 3F., No. 42, Yixin 2nd Rd., Qianzhen Dist., Kaohsiung City 806002, Taiwan (R.O.C.) (806002 高雄市前鎮區一心二路42號3樓).
Email: info@dudustudio.monster. Website: https://vettalon.dudustudio.monster.
Reporting a vulnerability
For the paid products, this website or anything else, email info@dudustudio.monster; a person reads and answers reports. Vulnerabilities in the open-source core can also be reported privately on GitHub.
Contacts are listed at https://vettalon.dudustudio.monster/.well-known/security.txt and the coordinated disclosure policy is at https://github.com/zhixuli0406/vettalon/security/policy.
Product and version
The paid product is the Vettalon desktop app (Apple Silicon Macs, Windows, Linux), activated with a Pro or Team license key. The running version is shown at the bottom of the app sidebar; installers and SHA-256 checksums for each platform are on the download page.
Support period
Every purchase has its own support period: from the purchase date until at least the end of the same calendar month 5 years later. A purchase on 20 October 2026 is covered until at least the end of October 2031; a purchase on 1 March 2027 until at least the end of March 2032. Each version is also supported for at least 5 years from its first release, and the later of the two dates applies.
Security updates are free throughout the support period and never need the Update Plan. The Update Plan covers new features and new major versions only. If a newer version requires payment, we release free security fixes for the latest version you can use without paying.
From desktop app 0.4.0, Settings > About Vettalon shows the month and year your support period ends, based on the date your license key was issued, and marks it once it has passed. The full terms are in section 5 of the Terms of Service.
How security updates reach you
The app checks for and downloads updates automatically. Once an update passes its Minisign signature check, the app asks before installing it; choose Later to postpone. In-app updates work on macOS, Windows and the Linux AppImage.
The Debian/Ubuntu .deb package is managed by the system package manager; install new versions from the download page. Where technically feasible, security updates are released separately from feature updates.
There is currently no setting to turn off the automatic update check. Installation always waits for your confirmation; while you postpone it, the fixed vulnerability stays on your computer, so install security updates promptly.
Intended use and where data goes
Vettalon reviews source code you own or are authorised to test, looks for possible security weaknesses and produces reports for people to judge. AI and static analysis can miss issues or raise false positives, so results need human review.
The app runs on your computer and sends no telemetry. It goes online only for license activation and the license check every 30 days, the cloud model providers you configure (deep review sends selected code and context), update checks and downloads, and supply-chain hunting queries to package registries and OSV.
Check a cloud provider's data policy before using it; for confidential projects you can use a local model instead. Detected secrets are redacted before any report or SARIF file is written.
Deactivating and removing data
Before moving to another computer or uninstalling, open Settings > License and choose Deactivate this computer to free the device slot, then remove the app.
The license cache, device ID, model settings and saved scan reports live in the .vettalon folder in your home directory (~/.vettalon on macOS and Linux, %USERPROFILE%\.vettalon on Windows). Deleting that folder removes them. Exported reports are saved where you chose; delete those separately.