We take the security of our software products and components seriously, which includes all source code repositories managed through our In Extenso Digital's GitHub organization.

If you believe you have found a security vulnerability in any In Extenso Digital's repository that is aligned with Wikipedia's definition of a security vulnerability (English version, French version), please report it to us as described below.

We prefer all communications to be in English, but if you are not comfortable, French is acceptable too.

⚠️ Please do not report security vulnerabilities through public GitHub issues.

Instead, please report them by email to [email protected].

You should receive a response as soon as possible. If for some reason you do not, please follow up via email to our Administrator Team to ensure we received your original message.

For private repositories, you can also send an email or directly use the dedicated issue template for security vulnerability.

💡 When reporting an issue, a general rule of thumb is to provide as much information as possible in order to facilitate the issue.

The following should be provided at all times if possible:

• Type of issue (e.g. Denial of service, Elevation of privilege, Information disclosure, Remote Code Execution, Security feature bypass, buffer overflow, SQL injection, cross-site scripting, etc.)
• Full paths of source file(s) related to the manifestation of the issue
• The location of the affected source code (tag/branch/commit or direct URL)
• Step-by-step instructions to reproduce the issue, including any special configuration required to reproduce
• (if possible) Proof-of-concept or exploit code
• Description and Impact of the issue, including how an attacker might exploit the issue

This information will help us triage your report more quickly.

In Extenso Digital follows the principle of Microsoft's Coordinated Vulnerability Disclosure.