Found a flaw? Tell us privately.
Fill in the report opposite: it opens directly in your email app, ready to send. Private reporting, good-faith research, coordinated disclosure.
Appropriate reports
If you believe you have found a security vulnerability in a ProvSeal-owned website or distributed product, please report it privately so it can be investigated before public disclosure.
- Security vulnerabilities in provseal.fr or ProvSeal-owned web surfaces.
- Security defects in officially distributed ProvSeal software.
- Unexpected exposure of sensitive data caused by ProvSeal code.
- Reproducible failures in permission or trust-boundary enforcement.
Usually outside this process
These topics belong to other channels.
- Issues in the C2PA specification itself
- Social engineering and physical attacks
- Automated reports without demonstrated impact
- Also outside this process: unrelated third-party products, spam campaigns, product suggestions, support questions or content disputes.
Protect sensitive material
Do not email private keys, passwords, authentication tokens, confidential certificates or sensitive media. Start with a redacted description and ask for a safer transfer method if evidence contains secrets.
- Use a clear subjectEmail security@provseal.fr with “Security report” and the affected ProvSeal surface in the subject line.
- Minimize evidenceShare only the information required to reproduce and understand the issue. Redact personal data and third-party secrets. Limited screenshots, logs or a proof of concept should use your own accounts, systems and test media.
- Do not send signing secretsProvSeal should never need a private signing key to reproduce a product issue. Use test material and remove secrets from screenshots, logs and sample files.
Good faith
Please keep testing proportionate and limited to systems, accounts and data you are authorized to use.
- Stay on your own accounts, files and test certificatesUse your own accounts, files, certificates and non-production examples wherever possible.
- Stop as soon as sensitive data becomes visibleStop testing if sensitive information becomes visible.
- Report promptly, without exploitation beyond the demonstrationSend enough detail to reproduce the issue, then avoid further exploitation beyond what is needed to demonstrate impact.
To avoid
These actions put users or systems at risk.
- Accessing another person’s dataDo not access, modify, retain or disclose another person's data.
- Denial-of-service or mass testingDo not perform denial-of-service testing, destructive actions, spam, brute force or high-volume automated scanning.
- Publishing before the fixPlease allow time for investigation and remediation before posting details that could place users or systems at risk.
What happens next
How your report is handled, from first reading to disclosure.
- 1TriageThe report is reviewed for scope, reproducibility and likely impact. Additional information may be requested.
- 2InvestigationIf confirmed, the issue is prioritized and remediation is planned according to severity and affected users.
- 3CoordinationWhere practical, communication continues through remediation and a reasonable disclosure timeline is coordinated with the reporter.
- This page does not create a bug-bounty program, promise payment or guarantee a specific response or remediation deadline.
Thank you for protecting users.
A short, reproducible report is better than a long attachment.