Responsible Vulnerability Disclosure

Reporting policy — Version of 13 June 2026

This English translation is provided for information only; the French version is the legally binding reference.

Report a vulnerability

The security of PP2P ORVANE is a priority. If you discover a vulnerability, we invite you to report it to us responsibly, before any public disclosure, at the address:

security@pp2p.io

Please include a description of the issue, the steps to reproduce it and, if possible, an assessment of the impact.

Our commitments

  • Acknowledgment of receipt within 72 business hours.
  • Analysis of the report and assessment of criticality.
  • Remediation of critical vulnerabilities as soon as possible.
  • Updates to the researcher on the progress of the handling.
  • Acknowledgment of the contribution (with your consent), once the fix is deployed.

Scope and best practices

We ask researchers to:

  • not exploit the vulnerability beyond what is necessary to demonstrate it;
  • not access, modify or delete data that does not belong to them;
  • respect confidentiality until a fix is deployed;
  • act in good faith and in compliance with applicable legislation.

Reports compliant with this policy will not be subject to any legal action on the part of PP2P TECHNOLOGIES.

See also our security.txt file (RFC 9116).