Do you think you have found a security flaw in software from Unidus Consulting, or on this site? Please tell us. This page explains how, and what we do next.
What is in scope
- the software we deliver to our clients, including the source code that comes with it;
- this site, unidus-consulting.com.
Our clients' own systems are out of scope: if the flaw lies in their installation rather than in our software, write to us anyway and we will let them know.
How to reach us
Write to securite@unidus-consulting.com, in English or French. So that we can act quickly, please include:
- the software or page concerned, and its version if you know it;
- what the flaw allows;
- the steps to reproduce it;
- how you would like to be credited, or whether you prefer to remain anonymous.
What we commit to
- acknowledge your message within 5 working days;
- give you a first assessment within 10 working days: flaw confirmed or not, and its severity;
- keep you informed until it is fixed;
- fix it, warn the clients concerned, then publish an advisory;
- thank you publicly in that advisory, if you wish.
We do not pay bounties. We would rather say so plainly than let you hope otherwise.
What we ask of you
- give us time to fix the flaw before making it public: at most 90 days after your report, less if the fix ships earlier. We agree the date with you;
- do not access other people's data beyond what is needed to demonstrate the flaw, and do not keep it;
- do not destroy or alter anything, and do not disrupt the service (no denial of service, no mass sending);
- do not test against our clients' installations without their consent.
Our commitment to you
If you act in good faith and within these rules, we will not take any legal action against you, nor ask anyone else to. If a third party challenged you over this research, we would state publicly that you acted with our consent.
If we do not reply
If you have no reply from us within 10 working days, write again to contact@unidus-consulting.com. You may also contact CERT-MU, the national incident response team of Mauritius, where our company is established.
