MirLabs / Responsible disclosure
Responsible disclosure
Security is the core of what I build. If you find a flaw in one of my sites or bundles, I want to hear about it, privately, and I will treat your report seriously and quickly.
Scope
The sites and their subdomains:
The open-source Symfony bundles: Sentinelle, Fineprint, Echo, Uplift, Rehearsal. For a bundle, GitHub's private reporting (Security tab, "Report a vulnerability") works too where it is enabled; the email below always does.
How to report
Write to cdelage.dev@gmail.com with the subject "Security", in English or French. Include the site or bundle (with its version), the address or code concerned, the steps to reproduce, and what an attacker gains. A proof of concept helps; a polished report is not required. Do not put other people's data in your report.
If you need to send something sensitive, say so in a first email and we will agree on a channel.
What happens next
- Acknowledgement within 72 hours.
- A first assessment (confirmed or not, severity) within 7 days.
- A fix as fast as the severity requires: within 7 days for a critical flaw, 30 days for a high one, 90 days otherwise.
- News along the way, and a word when the fix is in production or released.
- For a bundle: a published GitHub security advisory (and a CVE when it applies), with credit to you if you wish.
Coordinated disclosure
Please keep the flaw private until it is fixed, or for 90 days after your report, whichever comes first. If a fix needs longer, I will tell you why and we will agree on a date together. Once it is fixed, you are welcome to write about it.
Safe harbour
Research done in good faith within this policy is welcome: I will not take legal action or file a complaint about it, and if someone else does about research that followed these rules, I will make it known that it was authorised.
The rules
- Stop at the first proof: never access, change, delete or keep data that is not yours.
- Use your own accounts and test data. Do not try to reach other users or their sessions.
- No denial of service, no load testing, no flooding of forms or emails, no spam.
- No social engineering, phishing or physical attempts against me, my clients or my providers.
- Do not test the hosting provider, the payment provider or other third parties: report to them directly.
Out of scope
- Reports from automated scanners without a demonstrated impact.
- Missing best-practice headers or cookie flags without a working attack.
- Clickjacking on pages with no sensitive action; self-XSS; logout or harmless-form CSRF.
- Rate limits on harmless forms; user enumeration through timing alone.
- Email domain settings (SPF, DKIM, DMARC) and the TLS configuration of the hosting.
- Vulnerabilities in outdated browsers, or that need a compromised device.
Rewards
There is no paid bounty. Public thanks on this page and in the advisory, if you wish.
Thanks
No report yet. Be the first.