Security and responsible disclosure
If you find a vulnerability, tell us first and give us reasonable time to fix it.
The security contact is not set up yet: address, encryption key and response times are [À VÉRIFIER]. Until then, do not send sensitive details to a general address.
How to report
- Contact: [À VÉRIFIER : security contact address]. A machine-readable security.txt (RFC 9116) will be published with it.
- Include what you found, how to reproduce it, and its likely impact. Send only the minimum data needed to prove it.
- We aim to acknowledge reports within [À VÉRIFIER] and to keep you informed until the fix.
Rules
- In scope: the API, the developer console and this website, once live.
- Do not access, change or delete other customers’ data. Stop at proof of concept.
- No denial of service, spam, social engineering or physical attacks.
- Give us reasonable time to fix before any public disclosure. Legal protection for good-faith research and any reward: [À VÉRIFIER].
Security measures of the website
| Measure | Detail |
|---|---|
| Content-Security-Policy | default-src, script-src and connect-src limited to the site (and the API origin for connect-src); no inline script or event handler on any page, checked at every build |
| Transport | Strict-Transport-Security for one year, including subdomains |
| Other headers | X-Content-Type-Options nosniff, X-Frame-Options DENY, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy turning geolocation, camera, microphone and payment off, Cross-Origin-Opener-Policy same-origin |
| Logs | The web server writes no access log |
| Third parties | No third-party script, font or analytics |
These headers are defined in the hosting manifest. They are not yet verified on a live deployment. [À VÉRIFIER]
Security measures of the API and console
- API keys and sign-in tokens are stored only as fingerprints (ZL-20, ZL-25).
- Error responses never return the offending value (ZL-12).
- One organisation cannot see another one’s keys or usage; revoked and expired keys are refused (ZL-26).
- The sign-in link travels in the URL fragment, is valid 15 minutes and works once. The session token is never put in a URL.