Security Tips

What’s already enforced for you

• The server decides. Every activation and every heartbeat re-applies the same gates — kill switch, license state, blacklist, platform, version, and build hash from one shared module. Activation and heartbeat can never disagree about whether a license is valid.
• Atomic device limits. Concurrent activations cannot overshoot a license’s device cap. Fifty simultaneous requests against a one-seat license grant exactly one.
• Revocation on the next beat. A license is re-read from the database on every heartbeat rather than trusted from a token, so a revoked key stops working within one beat.
• Vague refusals. An unknown key, a key belonging to another product, and a wrong password are all indistinguishable from the outside. Attackers cannot enumerate valid keys from the error responses.

What you should do as a developer

1. Do not remove the checks. Keep the refusal handling in place: if /activate or /validate returns anything other than success, stop. Don’t turn a failed validation into a warning.
2. Use HTTPS safely. All traffic is HTTPS already; if you modify the request layer yourself, add certificate pinning so a man-in-the-middle can’t substitute a fake “valid” reply.
3. Spread out your checks. Don’t only validate at startup. Use the heartbeat call POST /api/v1/validate on a timer every heartbeatSeconds and add your own integrity checks at multiple points in your code, not just one.
4. Do not hardcode sensitive data. Never embed license keys or your webhook signing secret in source or shipped configs. Keep secrets in environment variables.
5. Obfuscate your code, and turn on Build Hash checks. Even basic obfuscation or packing slows an attacker down; anti-debug / anti-inject is recommended where possible. Then register your binary’s SHA-256 under Settings → Build Hashes and enable Check Hash. A patched build then fails with INVALID_HASH even if it holds a valid key.
6. Update your program often. The longer a build sits unchanged, the more time an attacker has to study it. Ship updates, re-register the new build hash, and bump your version so old cracked builds fall below your minVersion gate and stop activating.

Webhook signature verification — worked example

whsec_••••••••••••••••••••••••

{
  "id": "cmskeyhvo0006yk77pz214vc0",
  "event": "activation.succeeded",
  "created": "2026-08-08T12:40:00.000Z",
  "data": {
    "licenseId": "4cab2fa9-923f-42c4-9465-58b63fe68515",
    "os": "Windows",
    "appVersion": "1.4.2",
    "user": "alex.dev"
  }
}

X-Frost-Signature: t=1786312800,v1=0aa0ab61b54e695cbd883c8fb41db716260032e17dcfb432d888d1f1223da4b3
X-Frost-Delivery: cmskeyhvo0006yk77pz214vc0

1786312800.{"id":"cmskeyhvo0006yk77pz214vc0","event":"activation.succeeded","created":"2026-08-08T12:40:00.000Z","data":{"licenseId":"4cab2fa9-923f-42c4-9465-58b63fe68515","os":"Windows","appVersion":"1.4.2","user":"alex.dev"}}

0aa0ab61b54e695cbd883c8fb41db716260032e17dcfb432d888d1f1223da4b3

import { createHmac, timingSafeEqual } from "crypto";

function verifyWebhook(rawBody: string, header: string, secret: string): boolean {
  const ts = /t=(\d+)/.exec(header)?.[1];
  const sig = /v1=([a-f0-9]+)/.exec(header)?.[1];
  if (!ts || !sig) return false;

  // Reject deliveries older than 5 minutes to kill replay windows
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;

  const expected = createHmac("sha256", secret)
    .update(`${ts}.${rawBody}`)
    .digest("hex");

  const a = Buffer.from(expected);
  const b = Buffer.from(sig);
  return a.length === b.length && timingSafeEqual(a, b);
}