Our customers' security depends on that of our products. If you think you have found a vulnerability, we want to hear about it and fix it, in coordination with you.
Scope
- The Wabba-Sego software, in its maintained releases.
- This website and the customer and partner portal.
Out of scope: denial of service and load testing, social engineering, physical access, third-party services (host, e-mail), and automated tool reports with no demonstrated impact.
How to report
Write to to be completed. Include:
- the product and its version, or the address concerned;
- a description of the vulnerability and its impact;
- the steps to reproduce it, and a proof of concept if you have one;
- your contact details, and whether you would like to be thanked publicly.
Our commitments
- Acknowledge receipt within three business days.
- Give you a first assessment within ten business days, then keep you informed until it is fixed.
- Fix according to severity, publish a security advisory and tell our customers.
- Notify the competent authorities of actively exploited vulnerabilities, as Regulation (EU) 2024/2847 (Cyber Resilience Act) requires.
- Thank you in the advisory, if you wish.
Coordinated disclosure
We ask you not to make the vulnerability public before it is fixed and the advisory is published, or at the latest 90 days after your report, unless we agree otherwise.
Good-faith research
We consider research to be carried out in good faith when it follows this policy: not accessing other people's data beyond what is needed to demonstrate the vulnerability, neither modifying nor keeping it, not degrading the service, and reporting the vulnerability to us without delay. We will not take legal action against such research.
Our security.txt file gives the same information.