Report a vulnerability

RFC 9116 /.well-known/security.txt · revised 2026-08-12

This site is run by a cybersecurity professional. A tool that assesses other people’s sites must accept - and make easy - that its own be examined. If you have found a flaw on conformitepme.ca, this page tells you how to report it to us and what we commit to doing next.

How to report

Write to [email protected] (security@ works too), in English or in French. What helps us fix it quickly:

• the affected address and the steps to reproduce the problem;
• the impact you observed, with a screenshot if needed;
• your name, if you would like to be thanked publicly - otherwise say so, and nothing will be published.

Our commitments

• an acknowledgement within 5 business days;
• follow-up until the fix - we tell you when it is resolved;
• public thanks if you wish;
• no bounty program for now - we would rather say so plainly than let you guess.

Good-faith research

We will not take legal action and will not file any complaint against a person who looks for and reports flaws in good faith. In good faith means:

• without degrading the service or overloading the server;
• accessing the minimum amount of information needed to demonstrate the flaw, without copying or sharing it;
• without touching other users’ accounts or data;
• without social engineering - against neither our customers nor us;
• giving us a reasonable time to fix the flaw before any public disclosure - 90 days works for us.

Scope

• In scope: conformitepme.ca, its pages and its application.
• Out of scope: the sites of the customers our tools assess - they asked you nothing - and third-party services (Stripe, Cloudflare), which have their own programs.