Report a Security Vulnerability
Report a Security Vulnerability
Report a security vulnerability
We welcome reports of potential security vulnerabilities affecting Webswing software, third-party components included in it, our Client Portal or our software distribution services.
You do not need an active license, paid support plan or portal account to report a security issue by email.
Email support@webswing.org with the subject “Security vulnerability” or “Security incident”. Clearly indicate if you suspect active exploitation or a compromised software package.
If you cannot reach us by email and have a Client Portal account, you can also submit a report through our Client Portal. Select “Open ticket” and include “Security vulnerability” in the subject.
Where possible, include:
- The affected Webswing version or service.
- A description of the issue and its potential impact.
- Steps and conditions needed to reproduce it, with a minimal example where available.
- Any evidence of active exploitation.
- Contact details for follow-up, if you wish to provide them.
Redacted logs or screenshots may help. You can submit a report even if you do not have all this information. Anonymous reports are also welcome.
Before submitting a report, you may wish to check our Release Notes to see whether the issue has already been addressed. Please select the relevant Webswing version in the documentation, as release notes are published separately for each version. If you are unsure, you are still welcome to report the issue.
Sharing sensitive information
Please do not include passwords, private keys, unnecessary personal data or confidential customer information in an ordinary email. Contact us first so that we can arrange a suitable protected channel for sensitive evidence.
We limit access to vulnerability reports to those who need the information to investigate, coordinate and respond to the issue.
How we handle reports
Reports received through our support system receive an automated acknowledgement and are assigned a ticket reference. Our team then reviews security reports and coordinates assessment with the relevant technical specialists.
Security reports are assessed and prioritized according to their potential impact and urgency, independently of the reporter’s license or support plan. Reports indicating active exploitation, compromised software packages or potentially severe security incidents are escalated for urgent assessment.
An automated acknowledgement confirms receipt only; it does not mean that the report has been assessed. The time needed for investigation and remediation depends on the nature, severity and complexity of the issue. Applicable legal reporting and notification deadlines take precedence over standard support timelines.
We assess the affected software or services, investigate the potential impact and determine appropriate corrective or mitigating measures. We may ask for additional information to reproduce or assess the issue.
Where you provide contact details, we will share relevant progress and coordinate disclosure timing with you.
Coordinated disclosure
Please report potential vulnerabilities promptly and give us a reasonable opportunity to investigate and prepare a correction or mitigation before publishing technical details that could put users at risk.
Where appropriate, we coordinate disclosure with the reporter, relevant component maintainers and other affected parties. Legal reporting obligations and timely protection of affected users take precedence over any proposed disclosure embargo.
When a security update is available, we publish appropriate information about the fixed vulnerability, including the affected software and versions, its impact and severity, and instructions to help users protect their systems.
In duly justified cases, we may delay publication of details about a fixed vulnerability where the security risks of publication outweigh the benefits, until affected users have had an opportunity to apply the relevant update.
Responsible testing
Only test software and systems that you own or have explicit permission to test. This policy does not grant permission to test Webswing infrastructure or customer environments.
Use only the minimum testing needed to demonstrate the issue. Avoid service disruption, data modification and access to information you are not authorized to view. If you encounter such information, stop testing and reporting the issue without copying or including that information.
