Skip to content
Omnifloo Office Try
Try without an account Sign up Sign in

Language

Draft — document under review by a lawyer. This policy may be clarified after review.

This translation is provided for information only: the French version of this document is the only legally binding version. Version française

Report a vulnerability

Responsible disclosure policy

Have you found a security flaw in Omnifloo Office? Please report it to us before any public disclosure: this lets us fix it and protect users.

1. How to write to us

Send your message to securite@omnifloo.com, in French or English. This information helps us reproduce the problem:

  • the address or feature concerned and the type of flaw;
  • the steps to reproduce it, with a screenshot or a short script if possible;
  • the impact you have observed or fear;
  • a way to reply to you, and the name under which you would like to be thanked, if you wish.

The same contact information is published in machine-readable form in the security.txt file (RFC 9116). Do not attach real personal data: describe its nature instead.

2. What we undertake to do

  • Acknowledge your report within 3 working days.
  • Assess the severity, keep you informed of progress and tell you when the flaw is fixed.
  • Fix the most serious flaws first, with no guaranteed fixed deadline: the time depends on complexity.
  • Not take legal action against a person who acted in good faith and followed the rules below.
  • Mention your name in our acknowledgements if you wish. We do not offer a financial reward.

3. What we ask of you

  • Limit your tests to what is strictly necessary to demonstrate the flaw, without viewing, changing or deleting data that is not yours.
  • Do not degrade the service: no denial of service, no load testing, no spam.
  • Do not exploit the flaw beyond the demonstration and do not pass it on to third parties.
  • Give us a reasonable time to fix it before any publication; failing agreement, 90 days after your report.

4. Scope

In scope: the Omnifloo Office portal, the file space, the document editing server and the other services available under the omnifloo.com domain and its subdomains. Out of scope: social engineering (phishing of our team or our users), physical attacks, the services of our providers (host, e-mail, payment), which have their own procedures, and reports from automated tools with no demonstrated impact.

5. Where we stand

The security measures in place are described on the Sovereignty and hosting page. The portal code has undergone internal audits followed by fixes and re-audits. No penetration test by an independent third party has been carried out to date: this is one of the reasons why your report is valuable.