Vulnerability disclosure
What this page covers. This is the disclosure policy for this site. The model for a manufacturer — full structure, safe harbour clause, and how it maps to the standards and to Annex I of the Regulation — is in Coordinated disclosure policy.
We welcome reports of vulnerabilities affecting this site. This page sets out how to reach us, what we commit to, and what we ask in return.
How to report a vulnerability
Address: [email protected]
Standardised file: /.well-known/security.txt
Languages accepted: English, French
Please include, where you can: the page or component concerned, a description of the vulnerability, reproduction steps, the estimated impact, and your contact details.
Scope
Covered: the site cra-reference.eu, any subdomains, and the files it publishes —
including /.well-known/security.txt,
/llms.txt and the sitemap.
This site is entirely static: no application server, no database, no user accounts, no cookies set. The only resource loaded from a third-party domain is the host’s audience measurement script, described in the legal notices. The attack surface is therefore small, but it is not nil — header configuration, integrity of the resources served, the publication chain.
Out of scope: the hosting provider’s infrastructure, third-party services we do not control, automated reports with no demonstrated impact, and observations concerning best practice alone with no established security consequence.
Our commitments
| Step | Interval |
|---|---|
| Acknowledgement | 3 working days |
| First qualified assessment, sent to the reporter | 10 working days |
| Progress updates | Every 15 days while the matter is open |
| Fix or reasoned position | By severity, within the interval stated at assessment |
| Coordinated publication | By default 90 days after the report, adjustable by agreement |
If we cannot fix within the agreed interval, we will tell you, explain why, and propose a new date.
Safe harbour
We will bring no civil action and file no criminal complaint against a person who, acting in good faith:
- stays within the scope described above;
- does not degrade the availability of the site;
- does not disclose the vulnerability before the agreed date;
- reports through the channel stated on this page.
This commitment does not cover actions taken for malicious purposes, nor actions that would infringe the rights of third parties.
What we ask
- A reasonable interval to fix before any publication.
- Coordination of the publication date with us.
- No demand for payment as a condition of disclosing the details.
Recognition
Unless you ask otherwise, we credit the people who report a vulnerability in the site’s revision log and on this page.
We do not operate a financial reward programme.
Alternative route
In France, Article L. 2321-4 of the defence code allows any person acting in good faith to pass information about a vulnerability to ANSSI, which preserves the confidentiality of their identity. That route remains open to you at any time, independently of this policy.
Reference framework
This policy follows the structure described in Coordinated disclosure policy, which draws on ISO/IEC 29147 (vulnerability disclosure) and ISO/IEC 30111 (vulnerability handling).
It does not fall under Regulation (EU) 2024/2847: this site is a documentation resource, not a product with digital elements placed on the market. It nonetheless applies the same logic, because a site that documents the coordinated disclosure obligation would be poorly placed not to honour it.