Report a vulnerability.
How to report a security flaw to us, the rules to follow, and what we commit to in return.
As a cybersecurity company, Abakus Sécurité welcomes vulnerability reports made in good faith. This policy sets out the scope, how to contact us, and the rules that apply on both sides.
1. Scope
This policy covers:
- the www.abakus-securite.fr website and abakus-securite.fr subdomains;
- services and systems exposed on the Internet by Abakus Sécurité.
Out of scope:
- third-party services (LinkedIn, hosting providers, partner vendors), which should be reported directly to their owners;
- our clients’ systems: if you find a vulnerability affecting them, contact the organization concerned or CERT-FR directly;
- reports produced solely by automated tools, without a demonstrated security impact.
2. How to report
Dedicated address: blueteam@abakus-securite.fr
Recommended encryption: public PGP key, fingerprint 0AE7 5E2F 3CBA 9D29 28C9 A868 F496 A0CA 04F8 F292
Reference file: security.txt (RFC 9116)
Languages: French or English.
To help us analyze your report quickly, please include:
- a description of the vulnerability and the affected component or URL;
- steps to reproduce it, with a proof of concept if possible;
- the estimated potential impact;
- the discovery date and a way to reach you (a pseudonym is fine).
3. Rules of engagement
While researching, please:
- limit testing to what is strictly needed to demonstrate the vulnerability;
- do not access, copy, modify or delete data that does not belong to you. If you accidentally access personal data, stop, do not keep it, and let us know;
- do not perform denial-of-service, load testing, social engineering, phishing or physical intrusion;
- do not install backdoors or keep access beyond the demonstration;
- do not disclose the vulnerability publicly before it is fixed or without our agreement.
4. Our commitments
- acknowledge your report within 5 business days;
- keep you informed of our analysis and remediation progress;
- coordinate any publication date with you, aiming for a fix within 90 days, adjustable depending on complexity;
- handle your report and identity confidentially;
- credit you publicly if you wish.
5. Legal framework
Abakus Sécurité will not take legal action against people who research and report a vulnerability in good faith and in line with this policy. This commitment does not cover actions that break the law or the rules above, nor third-party systems.
You may also report a vulnerability to the French National Cybersecurity Agency (ANSSI), which keeps the reporter’s identity confidential (article L. 2321-4 of the French Defence Code).
6. Rewards
Abakus Sécurité does not run a paid bug bounty program. Contributors can be publicly thanked with their consent.
7. Personal data
Information you send is used only to handle your report and communicate with you, in accordance with our personal-data policy.
Last updated: October 18, 2026.