TotalLab security

Vulnerability disclosure policy

TotalLab Ltd welcomes reports of security vulnerabilities in its products. This policy explains how to report one and what you can expect from us.

Scope

All software products published by TotalLab Ltd, including their installers, updates and the components we ship with them. Report vulnerabilities in a third-party component to its maintainers as well; we will still want to know if a TotalLab product is affected.

How to report

Email security@totallab.com with:

• the product and version affected;
• a description of the vulnerability and its impact;
• steps to reproduce it, or a proof of concept;
• whether you believe it is being actively exploited;
• how you would like to be credited, if at all.

Please do not include customer data or other personal data you may have come across.

What happens next

• We will acknowledge your report within 5 working days.
• We will tell you whether we have confirmed the vulnerability, and keep you informed of our progress towards a fix.
• When a fixed version is available we will publish an advisory on this site, crediting you if you wish.

We ask that you give us reasonable time to fix the vulnerability before disclosing it publicly. We aim to release fixes within 90 days of a confirmed report and will agree a disclosure date with you.

Good-faith research

We will not take legal action against anyone who finds and reports a vulnerability in good faith and in line with this policy: who avoids harming our customers, their data and our services, does not access more data than is needed to show the vulnerability, and gives us the chance to fix it before disclosing it.

Regulatory reporting

Under the EU Cyber Resilience Act, TotalLab notifies actively exploited vulnerabilities and severe incidents affecting its products to the relevant CSIRT and ENISA.