Skip to content

Coordinated vulnerability disclosure policy

✨ Found a vulnerability in a la Vitre product? Here is how to report it to us and how we handle your report.


Purpose

la Vitre takes the security of its products and customers seriously. This policy explains how to report a vulnerability to us and how we handle your report.

It meets Regulation (EU) 2024/2847, the Cyber Resilience Act (CRA), Annex I, Part II, point 5. It is based on the ISO/IEC 29147 standard.

Scope

This policy covers:

  • the la Vitre application for Windows;
  • the Companion, on the web and on mobile;
  • the administration portals;
  • la Vitre APIs and online services, under the lavit.re, lavitre.me and lavitre.space domains;
  • the relay servers (TURN) operated by la Vitre.

Out of scope:

  • our providers' infrastructure (for example Scaleway, Netlify, Google, Microsoft);
  • our customers' devices and networks;
  • social engineering and phishing;
  • denial of service;
  • destructive testing, or testing on customer data.

How to report

Email security@lavitre.fr, in French or in English.

Please include:

  • the product or service affected, and its version if you know it;
  • a description of the vulnerability and its possible impact;
  • the steps to reproduce it;
  • your proof of concept, if you have one;
  • the date you found it;
  • your contact details, and whether you want public thanks.

For sensitive details, we can agree with you on an encrypted channel.

Our security.txt file is published at https://lavit.re/.well-known/security.txt.

Security lead

The security of la Vitre products and the handling of reports are the responsibility of Thierry Bouquain, Chief Information Security Officer (CISO) of LA VITRE SAS. Reports sent to security@lavitre.fr reach him directly.

Our commitments

  • Acknowledge your report within 2 business days.
  • Send you a first qualified response within 10 business days.
  • Fix the vulnerability within the times below, counted from its confirmation.
  • Keep you informed of progress and tell you when the fix is released.
  • Report any actively exploited vulnerability to CERT-FR, as the CRA requires.
Severity CVSS score Time to make the fix available
Critical, actively exploited 9.0 to 10.0 Workaround within 72 hours; fix within 7 days
Critical 9.0 to 10.0 7 days
High 7.0 to 8.9 30 days
Medium 4.0 to 6.9 90 days
Low 0.1 to 3.9 120 days or next release

What we ask of you

  • Do not access or modify other people's data. If you access it by accident, stop and tell us.
  • Stop at a proof of concept.
  • Do not degrade the service for other users.
  • Do not disclose the vulnerability publicly before it is fixed. If it is not fixed 90 days after your report, we agree on a publication date together.

Safe harbor

la Vitre does not take legal action against good-faith researchers who follow this policy.

Acknowledgement

With your consent, we thank you publicly. la Vitre does not offer monetary rewards.

Security advisories

We publish a security advisory for fixed vulnerabilities, with the affected versions and the actions to take.

Further resources

Last updated: 28 October 2026.


✨ Missing information?
This Help Center evolves with your needs.

Let us know which terms, features, or use cases should be clarified, or contact support for personalized assistance.

Bringing you closer to what matters. We are enriching this resource together.