Security Policy
Reporting a vulnerability
The security of our modules and the solutions we develop for our customers is paramount. That's why we encourage security researchers to carry out analyses on our solutions and to report any identified vulnerabilities to us, in line with good practice in responsible disclosure.
If you think you have discovered a vulnerability in one of our modules, you can report it to us responsibly via our contact form
Please provide as much detail as possible in your report:
Essential information to include
- Detailed description: Clearly explain the nature of the vulnerability identified
- Impact assessment : Describe the potential consequences for users or sites
- Versions affected : Specify the versions of the modules affected by the vulnerability
- Reproduction stages : Provide a step-by-step guide to reproducing the problem
- Proof of concept : If possible, include relevant screenshots or code extracts
Our vulnerability management policy
In accordance with TouchWeb charter for responsible cyber securityOur team applies the following principles:- Acknowledgement of receipt of all relevant reports within a maximum of 7 days. (CVSS ≥ 7.5)
- Impact analysis and planning of a patch within 30 days.
- Publication of a security advisory with CVE if the CVSS score is ≥ 7.5.
- No corrections will be published silently.
- Not to prosecute researchers acting in good faith, in particular as part of the YesWeHack programme managed by TouchWeb SAS.
- Guarantee that no confidentiality agreement, including a white label agreement, can hinder the transparent publication of a security advisory with a CVE identifier, in compliance with the state of the art.
Authorisation for publication
We expressly authorise TouchWeb SAS to publish information about corrected vulnerabilities in our modules on its official website, in line with the commitments of the Responsible Cyber Security Charter. This publication includes :- A CVE identifier associated with the vulnerability.
- A safety note clearly describing the problem and its resolution.
- The versions concerned and the corrected version.
- A patch that is easy to deploy when updating is not possible.
- Any useful information enabling users and agencies to protect themselves quickly.
