FR — Français

Vulnerability disclosure policy

Blooo protects critical organisations: we hold ourselves to what we ask of our clients. If you believe you have found a vulnerability in a Blooo system, please report it to us responsibly. We will treat it seriously and in confidence.

Scope

  • In scope: blooo.io and www.blooo.io.
  • Out of scope: our clients’ and suppliers’ systems (report those to their owners directly), denial-of-service attacks, social engineering and physical access.

How to report

  • Write to security@blooo.io, encrypting your message with our PGP key if you can (fingerprint 07BF 3A24 6616 3EF6 CC90 412E 8618 0ECB E52C 6D61).
  • Describe the vulnerability, the steps to reproduce it, its likely impact, and your contact details if you would like us to get back to you.
  • Do not attach personal or confidential data obtained during your tests.
  • Your contact details are kept only until the issue is resolved. If you would rather have them deleted as soon as your report is received, say so in your message (see the privacy policy).

Our commitments

  • Acknowledge your report within 2 business days.
  • Give you a first update on our analysis within 5 days, then keep you informed until the fix.
  • Agree with you on a public disclosure date once the fix is in place, no later than 90 days after your report.

What we ask of you

  • Act in good faith and test only what is needed to demonstrate the vulnerability.
  • Do not access, change or delete data that is not yours, and stop testing as soon as any personal data is exposed.
  • Do not disclose the vulnerability before it is fixed and without our agreement.

Blooo will not take legal action against anyone who reports a vulnerability in good faith and in line with this policy, within the limits of French law. You may also report a vulnerability to ANSSI, the French national cybersecurity agency, under Article L. 2321-4 of the French Defence Code.