There is no APK to download

The headshot desk is built as a single web property served at headshotin.com. The choice is editorial, not technical. A web property can be updated, audited and versioned without forcing every reader to download a new installer. It also keeps the publication surface transparent — every page on the desk is reachable by URL and inspectable by the reader.

An installer would be a different surface with a different update cadence and a different trust model. The desk has decided not to maintain that surface. If a future version of the desk changes that decision, the change will be announced on the newsroom with a transition plan and a verification note.

For readers who want one-tap access on a phone, the recommended path is to add the site to the home screen. The shortcut opens the desk in a dedicated window with the same favicon the desk uses in the browser tab. The shortcut is offered by the phone, not by the desk, and it never asks for unusual device permissions.

The desk routes reports of unauthorised third-party download surfaces to the security contact listed on the contact page. If a credible surface is identified, the desk publishes a public note on the newsroom. The desk never republishes a phishing URL in public copy and never names a phishing surface without verifying the report with a security partner.

For readers who have already downloaded a third-party surface by mistake, the desk's standard advice is to uninstall, run a security scan, and reset any passwords that were entered on the third-party surface. The desk does not collect passwords, so the desk's password reset is not relevant.

A search engine result for "headshot download" usually returns a mix of legitimate and illegitimate surfaces. The legitimate surfaces include the desk's homepage, the desk's app-access page, the desk's download-context page, and the desk's official-website page. The illegitimate surfaces include phishing mirrors, tracking surfaces, and fake "download managers" that ask for unusual device permissions.

The desk's editorial standard on search results is to surface the verification step. The reader should check the URL bar, the certificate, and the canonical list on the official-website page. The reader should not enter a password on a "headshot download" surface. The reader should not grant unusual device permissions on a "headshot download" surface. The reader should close the surface and verify the URL bar against the canonical list.

The desk's standard practice is to publish the verification step on the official-website page and to surface the verification step on the contact page. The desk does not pay for search engine placement. The desk does not run a sponsored search engine result. The desk's editorial surface is the canonical URL, and the surface is not for sale.

When a third-party surface is reported, the desk's standard practice is to verify the surface against the canonical list on the official-website page. If the surface is not on the list, the desk's next step is to read the surface's terms of use, privacy notice, and contact information. The three documents are typically the strongest signal of a surface's editorial discipline. A surface that hides the canonical source, hides the privacy notice, or hides the contact information is a higher-risk signal than a surface that surfaces all three.

The desk's next step is to read the surface's certificate. A valid certificate is a necessary but not sufficient signal. A certificate issued by a trusted authority is a stronger signal than a certificate issued by an untrusted authority. The desk publishes the verification standard on the official-website page so that the reader can apply the standard to any third-party surface.

The desk's final step is to publish a public note on the newsroom if a credible surface is identified. The note names the surface, the affected reader class, and the verification steps. The desk does not republish a phishing URL in public copy. The desk does not name a phishing surface without verifying the report with a security partner. The desk's role is to surface the verification standard; the reader's role is to apply the standard.