Vulnerability disclosure policy

Provisional text, pending legal review. It is not the final version.

Last updated Nov. 4, 2026

The security of our services matters to us and to our customers. If you think you have found a vulnerability, please report it to us. This policy explains how to do it, what you may test and what we commit to.

How to contact us

Write to security@scaliamo.com. This address is also given in the /.well-known/security.txt file of each of our websites and of our application, following the RFC 9116 standard.

In your message, please state if possible:

• the address or feature concerned;
• the nature of the vulnerability and its possible impact;
• the steps to reproduce it;
• your contact details, if you would like a follow-up.

You can write in French or in English.

Scope

In scope:

• the websites of our products;
• our application, its API and its widget.

Only the domains we operate are in scope. The services of our providers (hosting, payment, e-mail delivery) fall under their own policies.

Out of scope

• denial-of-service attacks, in any form;
• social engineering aimed at our teams, our customers or our providers (phishing, calls, messages);
• physical tests on our premises or equipment;
• mass sending of messages through our forms (signup, waitlist, contact);
• automated mass scanning, by scanner or bot;
• reports from an automated tool without a demonstration of real impact.

Good faith rules

We ask you to:

1. test only with your own accounts, or with accounts whose holder has given you their consent;
2. never view, modify, copy or delete data that does not belong to you; if you access such data by accident, stop, keep nothing and report it to us;
3. do only what is strictly necessary to demonstrate the vulnerability;
4. not degrade the service for other users;
5. not disclose the vulnerability before it is fixed, nor before the date agreed with us;
6. not ask us for anything in return for your report.

Our commitments

Our timeframes:

• acknowledgement of receipt within 3 working days;
• first assessment (vulnerability confirmed or not, severity) within 10 working days;
• fix according to severity, with a progress update at least every two weeks;
• coordinated disclosure: we agree with you on a publication date, in principle no more than 90 days after the report.

We keep you informed of the fix. With your consent, we can name you in our acknowledgements.

No bug bounty programme

We do not have a bug bounty programme. No financial reward is paid for a report.

Legal framework

We will not take legal action against a person who reports a vulnerability in good faith and complies with this policy. If a third party takes action against you for research that complies with this policy, we will make it known that you acted with our authorisation.

This policy does not authorise you to break the law, nor to access our customers' data.

Changes to this policy

We may change this policy. The version published on this page prevails.