Report a vulnerability
Responsible disclosure policy
STRACKLE SAS operates various governance systems and services.
The security of our clients and their data is at the core of what we do. If you believe you have found a security flaw in our services, we thank you for reporting it: this page explains how, and what we commit to do.
Scope.
The services STRACKLE SAS operates itself, and only those: this website and the platforms it makes available to its clients. Services run by our providers fall under their own policies.
How to report.
Write to security@strackle.com, describing what you observed: the service and address concerned, the steps to reproduce, the impact you estimate, and, if you wish, your name so we can thank you.
What we commit to do.
Acknowledge receipt within two working days. Keep you informed of the analysis and the fix. Fix the issue within a timeframe proportionate to its severity, and let you know when it is done. Not take legal action against anyone who reports in good faith, in keeping with the rules below. Credit you, if you wish, once the fix is in place.
What we ask of you.
Do not access, modify or delete data that is not yours, and stop as soon as the flaw is demonstrated. Do not disrupt the service (denial of service, brute force beyond what proves the point). Do not disclose the flaw publicly before it is fixed and we have agreed on a date. Do not exploit the flaw beyond demonstrating it.
What is out of scope.
Social engineering of our staff or clients; physical access to our premises or those of our hosting providers; reports from automated tools without a demonstrated impact.