--- title: "Vulnerability disclosure policy" description: "How to report a vulnerability in CLAQON or its website: contact, what to include, what we will do, scope and protection for good-faith researchers." url: https://claqon.com/en/legal/vulnerability-disclosure/ language: en updated: 2026-10-12 alternates: es: https://claqon.com/legal/divulgacion-de-vulnerabilidades/ pt: https://claqon.com/pt/legal/divulgacao-de-vulnerabilidades/ --- Legal # Responsible vulnerability disclosure policy If you find a security flaw in CLAQON or on this website, tell us before making it public. We explain how to do it, what we will do and how we protect you if you research in good faith. In force since 13 October 2026 Courtesy translation: in case of discrepancy, the Spanish version prevails. [Español](https://claqon.com/legal/divulgacion-de-vulnerabilidades/) This responsible vulnerability disclosure policy explains how to report a security flaw in CLAQON or on this website to us, what we will do when we receive it and which rules we ask you to follow. The product’s security measures are described in [security](https://claqon.com/en/security/). ## Scope This policy covers: - **The CLAQON software:** the panel, the production engine, the installers and the backup, update and licensing systems, in the versions we maintain. - **This website** and the files it publishes, such as `security.txt`. The following are out of scope: - **Third-party services** that CLAQON uses or connects to, such as YouTube, Meta, X, AI providers, Docker or FFmpeg. Report to them directly. If the flaw lies in how CLAQON uses one of those services, it is in scope. - **Other people’s installations.** Test only on an installation of your own or a test installation, never on a customer’s without their permission. - **Denial-of-service or load testing,** social engineering, phishing against our team or our customers, and physical attacks. - **Automated reports without demonstrated impact,** such as scanner output without proof that the flaw can be exploited. ## How to report - **Write to us at [soporte@claqon.com](mailto:soporte@claqon.com)** with the subject “Security”. If the address in our [/.well-known/security.txt](https://claqon.com/.well-known/security.txt) file is different, use that one. - **A person will deal with your report,** not an automated system. You can write to us in Spanish or in English. - **No encryption key for now.** We do not yet publish an OpenPGP key. Do not include personal data or secrets in your first message: if necessary, we will agree a secure channel with you. - **If you prefer,** you can report through an incident response team (CSIRT) that coordinates the disclosure, or without identifying yourself. ## What to include in your report 1. The affected component and its version. The CLAQON version is shown in the panel. 2. A description of the flaw and its impact. 3. The steps to reproduce it and, if you have one, a proof of concept. 4. Whether you know it is already being exploited. 5. How to contact you and whether you would like us to mention you when it is published. ## What we will do - **Acknowledge receipt** of your report and keep you informed of its progress. - **Analyse and reproduce it,** and assess its severity with you if necessary. - **Fix it** with a signed security update, kept separate from functional improvements where feasible. - **Coordinate publication with you** and acknowledge your work if you wish. - **Notify those affected,** through the product’s notification channels and in the [changelog](https://claqon.com/en/changelog/). - **Notify the authorities** of exploited vulnerabilities and severe incidents when the Cyber Resilience Act requires it. **Indicative timescales.** We acknowledge receipt within 5 working days at most. We aim to fix critical and severe flaws within 90 days at most; if we need longer, we will discuss it with you before that period expires. We do not currently offer financial rewards for reports. ## Good-faith research If you research in good faith and follow these rules, we will not take legal action against you for that research and we will consider it authorised: - test only on your own or test installations, and on this website without interfering with its operation; - do not access, modify, copy or delete other people’s data beyond the minimum needed to demonstrate the flaw; - stop and let us know as soon as you have demonstrated it; - do not degrade the service or put our customers at risk; - keep the information confidential until we publish the fix or agree a date with you; - comply with the law. This commitment cannot cover third-party claims, such as those of a customer whose installation you have tested without their permission, nor prevent us from acting if these rules are broken. ## Coordinated disclosure We will agree with you a date for publishing the flaw, normally when the fix is available. We will publish an advisory with the description, the affected versions, the fix and, if you wish, your name. If the flaw is being exploited, we may bring the advisory forward to protect CLAQON users. ## Cyber Resilience Act Regulation (EU) 2024/2847, the Cyber Resilience Act, requires the following of manufacturers of products with digital elements: - a coordinated vulnerability disclosure policy and a point of contact for receiving reports, such as this page; - from 11 September 2026, notification of actively exploited vulnerabilities and severe incidents through ENISA’s single reporting platform: an early warning within 24 hours, a notification within 72 hours and a final report; - remediation of vulnerabilities without delay, through security updates. Its general obligations apply from 11 December 2027. **How it applies to CLAQON.** CLAQON is software that is installed on the customer’s machine: when it is placed on the market in the European Union, it will be a product with digital elements and its owner will be its manufacturer. From then on, we will comply with the notification obligations and, once the general obligations apply, we will publish for each version a security support period of at least five years, unless its expected lifetime is shorter, as explained in the [licence](https://claqon.com/en/legal/license/#actualizaciones). ## The security.txt file In line with the RFC 9116 standard, we publish at [/.well-known/security.txt](https://claqon.com/.well-known/security.txt) the contact for security reports, its expiry date, the preferred languages and the link to this policy.