Responsible disclosure
Report a security vulnerability
Have you found a vulnerability in ARALLIA? Thank you: here is how to report it to us, what you can expect from us and what we ask of you.
How to write to us
Write to [security@example.org: address to be completed] with a clear subject (“ARALLIA vulnerability”). If possible, encrypt your message with our public key [fingerprint and link: to be completed]. The contact details are also in the /.well-known/security.txt file (RFC 9116).
What your report should contain
- a description of the vulnerability and its potential impact;
- the precise steps to reproduce it (address, request, test account used);
- the version, the date and your browser or tool, if relevant;
- your contact details, if you would like a reply (an anonymous report is accepted).
Our commitments
- to acknowledge receipt within [3 working days: to be confirmed];
- to keep you informed of progress and of the fix;
- not to take legal action against a person who follows the rules below and acts in good faith;
- to credit you publicly if you wish, once the vulnerability has been fixed.
What we ask of you
- not to access other people’s data beyond what is strictly necessary to demonstrate the vulnerability, nor to modify or delete it;
- not to degrade the service (no denial of service, no load testing, no spam);
- not to use social engineering or phishing against the team or the users, nor any physical attack;
- to allow us a reasonable time to fix it before any public disclosure [period: 90 days, to be confirmed].
Scope
The ARALLIA website, its API and their subdomains are concerned [list to be completed]. Vulnerabilities in third-party services (host, map provider) must be reported to their publishers. No bounty is planned for the moment.