Vulnerability disclosure policy

Send your report to security@arpe.io, in English or French. If you think the issue is critical, say so in the subject line.

Please include, as far as possible:

• the product and version (e.g. FastBCP 1.4.1) and the operating system;
• a description of the vulnerability and its potential impact;
• steps to reproduce, a proof of concept or sample configuration (with no real credentials or customer data);
• how you would like to be credited, or whether you prefer to remain anonymous.

• We acknowledge your report within 2 business days.
• We send an initial assessment (confirmed or not, severity) within 10 business days.
• We keep you informed of progress and agree with you on the publication date.
• Once a fix is released, we publish an advisory on this site and credit you, unless you prefer to remain anonymous.

Please give us reasonable time to release a fix before any public disclosure: 90 days by default, which we may agree to shorten or extend together depending on the complexity of the fix.

In scope: FastBCP, FastTransfer, MigratorXpress, LakeXpress and the Arpe.io ADBC drivers, in their latest version.

Out of scope: vulnerabilities in third-party dependencies already listed in our reports (unless you show they are exploitable in our product), social engineering, physical attacks, and denial-of-service testing.

We will not take legal action against researchers who act in good faith, follow this policy, avoid accessing or modifying data that is not theirs, and do not disrupt our services or those of our customers.