We take the security of our software products and components seriously, which includes all source code repositories managed through our In Extenso Digital's GitHub organization.

If you believe you have found a security vulnerability in any In Extenso Digital's repository that meets Wikipedia's definition of a security vulnerability (English version, French version), please report it to us as described below.

⚠️ Please do not report security vulnerabilities through public GitHub issues.

Instead, please report them by email to rssi@inextenso.digital.

You should receive a response as soon as possible. If for some reason you do not, please follow up via email to our Administrator Team to ensure we received your original message.

For private repositories, you can also send an email or directly use the dedicated issue template for security vulnerability.

💡 In any ways, please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue:

• Type of issue (e.g. Denial of service, Elevation of privilege, Information disclosure, Remote Code Execution, Security feature bypass, buffer overflow, SQL injection, cross-site scripting, etc.)
• Full paths of source file(s) related to the manifestation of the issue
• The location of the affected source code (tag/branch/commit or direct URL)
• Step-by-step instructions to reproduce the issue, including any special configuration required to reproduce
• (if possible) Proof-of-concept or exploit code
• Description and Impact of the issue, including how an attacker might exploit the issue

This information will help us triage your report more quickly.

We prefer all communications to be in English, but if you are not comfortable, French is acceptable too.

In Extenso Digital follows the principle of Microsoft's Coordinated Vulnerability Disclosure.