Vulnerability disclosure policy

How to report

Email [security@domaine.fr]. Please include:

• the affected URL or API endpoint and a description of the issue;
• the steps to reproduce it, and a proof of concept if you have one;
• the impact you think it has;
• how you would like to be credited, if at all.

Please do not use the contact form for vulnerability details. Our contact information is also published in /.well-known/security.txt (RFC 9116).

Scope

• This website: portolan.snap.ovh, including the client portal and its API.
• The portolan-worker analysis agent.

Out of scope: denial of service, social engineering, physical attacks, and services operated by third parties.

Rules

• Only test with accounts and data you own. Never access, modify or delete other users' data.
• If you reach personal or client data, stop, keep no copy, and report immediately.
• Do not degrade the service: no load testing, and keep automated scanning slow.
• Give us reasonable time to fix the issue before disclosing it — 90 days by default, sooner once it is fixed.

Our commitments

• We acknowledge your report within 3 business days and keep you informed until it is resolved.
• We credit you publicly if you wish once the issue is fixed. We do not run a paid bug bounty.
• We will not take legal action against research carried out in good faith within these rules. In France you can also report a vulnerability to ANSSI, which protects the identity of reporters (article L. 2321-4 of the Defence Code).