Skip to content

security

Vulnerability disclosure policy

last updated

This policy belongs to HIDENENTERPRISES S.L. for its Duravigil service. It explains how to report a security flaw to us, what we do with the report, how quickly, and what protection you have if you research in good faith. We review it at least once a year.

1. Scope

This policy covers the systems we run:

  • The website www.duravigil.com and the other subdomains of duravigil.com that we operate, including the client platform app.duravigil.com.
  • The domains duravigil.es, duravigil.cat, duravigil.eu, duravigil.net and durabigil.com.
  • The Duravigil monitoring platform and its related services, including the automated security test.

Out of scope:

  • Products of the manufacturers we work with. Report those to the manufacturer under its own policy. We do not confirm who our customers are.
  • Third-party services we use, such as Cloudflare or Microsoft 365. Report those to each provider through its own programme.

2. How to report

Write to security@duravigil.com, in English or Spanish. So that we can handle it properly, include:

  • Which system or address is affected.
  • What you found and what impact you think it has.
  • The steps to reproduce it and, if you have one, a proof of concept.
  • When you found it.
  • How to reach you with questions: an email address or a phone number.

We recommend sending confidential information encrypted and signed. We are preparing our OpenPGP key; once it is published we will link it here and in the security.txt, with its fingerprint. Until then, if the details are sensitive, write to us first without them and we will agree on how to send them.

Anonymous reports

You can write from an address that does not identify you. Bear in mind that if we cannot ask you questions, we may be able to handle the report only in part, or not at all. If the problem is complex, we will probably need more explanation or documentation.

3. Response times

  • Acknowledgement within 5 working days of your report or of each update you send us. A person writes it; it is not an automatic reply.
  • A detailed answer within 10 working days, with one of these three: whether we confirm or rule out the vulnerability, the questions we need answered to understand it, or why the investigation will take longer, with a commitment to send you another update within 10 working days at most.

We count working days by the calendar of Cervera (Lleida, Spain). These times do not apply to anonymous reports, because we have no one to answer. You can ask about the status of your report at any time.

4. What we commit to

  • We treat each report as confidential as far as the law allows. We publish only what is needed to disclose the vulnerability once it is fixed.
  • We do not give your personal data to third parties without your express permission.
  • We answer within the times in this policy and stay available throughout the process.
  • We do not ask you to sign a non-disclosure agreement.
  • If you wish, we thank you publicly by name or alias once the case is closed.

Protection if you act in good faith

If you research in good faith and follow this policy, we will not take legal action against you or report you to the authorities for that research, and we will consider it authorised by us. If a third party takes action against you for something you did within this policy, we will make it clear that you acted under it. This does not apply where there is recognisable criminal intent.

5. What we consider a vulnerability

We handle as a vulnerability a flaw that:

  • affects one of the systems in scope;
  • is not public yet;
  • comes with an explanation, and is not just the output of an automated tool without further documentation.

If you report something we have already fixed, we read it and check it anyway. Findings such as recommended headers or settings without a demonstrable impact are welcome, although they do not usually go through the whole process.

6. What we ask of you

  • Do not use the flaw beyond what is needed to demonstrate it, and do not cause any harm.
  • Do not access, change or delete data that is not yours. If you reach other people's personal data, stop, tell us and do not keep it.
  • Do not run denial-of-service attacks, mass mailings, brute force, social engineering or physical tests.
  • Do not put at risk or change third-party systems or data.
  • Do not offer anyone tools to exploit the flaw.
  • Do not publish the flaw before it is fixed or before we agree a date with you.

We ask everyone involved to treat each other with respect. We do not accept insults or discrimination of any kind. If a report does not follow these guidelines, we will still handle it as far as we can, but we will not thank its sender publicly.

7. Coordination and disclosure

We agree the publication date with you. We publish confirmed vulnerabilities no later than 90 days after we validate them. If there is a justified reason to take longer to fix one, that period can be extended once by another 90 days, in agreement with you and with the CSIRT designated as coordinator in Spain, where we are established.

If the vulnerability is being actively exploited, we will notify that CSIRT without undue delay and keep it informed of how the fix progresses.

8. When a case is closed

We consider a case closed when one of these happens:

  • the vulnerability is fixed and has been published;
  • we find that the report has no basis, and we explain why;
  • you do not answer our technical questions for at least 30 days and we cannot go on without your help.

We tell you when we close it, unless the report was anonymous.

9. Rewards

We do not have a paid reward programme at the moment. With your permission, we do thank publicly anyone who reports a valid vulnerability to us.

10. Contact and languages

This policy is also published in Spanish, which prevails if the two differ: Política de divulgación de vulnerabilidades.