Reporting a vulnerability.

How to report

Write to [email protected] with “Security” in the subject. Please include the edition and version (shown in the About window), your system, what you found and how to reproduce it. Do not publish the problem, and do not open a public issue, before it is fixed.

What we do

• We acknowledge your report within 2 working days.
• We assess it, keep you informed, and agree with you on a disclosure date — usually once the fix is published, and at the latest after 90 days.
• A vulnerability that is actively exploited is notified to the French national CSIRT (ANSSI) through the European single reporting platform: an early warning within 24 hours, a notification within 72 hours, then a final report, as required by the Cyber Resilience Act (Regulation (EU) 2024/2847, Article 14). Users are informed of the risk and of what to do.
• With your agreement, we thank you by name in the release notes.

What is covered

Every edition of LiberUnda, the separate programs delivered with it, the licence service and liberunda.com. Each major version receives free security fixes for five years from its first release — LiberUnda 1 until 31 December 2031 — and a LiberUnda Pro licence is covered for at least 24 months after purchase. Fixes are announced on the security advisories page and published on the download page and listed in What’s new.

Please don’t

Access or change other people’s data, disrupt a station on air, run denial-of-service tests, or use social engineering. We do not run a paid bounty programme.

Machine-readable contact: /.well-known/security.txt.