Vulnerability disclosure

Last updated 18 August 2026

Scope

This policy covers this website and the form endpoints it uses. It does not cover any other website, product or service, including the other activities shown in the footer of this site and the systems our suppliers operate.

How to report

Please report suspected vulnerabilities privately, with enough detail to reproduce the issue, and give us reasonable time to respond before any public disclosure. Send reports to guillaume@letztec.com, which is monitored. Reports are handled by the Qytos security team. Our machine readable contact is published at /.well-known/security.txt.

What we ask

Do not access or modify data that is not yours, degrade the service, or run automated scanning that disrupts other users. Test only against your own submissions.

Our commitments

We will acknowledge your report within three business days.

We will tell you our initial assessment, including whether we have been able to reproduce the finding and how we rate its severity, within ten business days of acknowledgement.

We will keep you informed of progress at least every thirty days until the matter is closed, and we will tell you when it is resolved.

We ask that you give us ninety days from acknowledgement before disclosing publicly, and we will work with you on timing if you need to move sooner or if we need longer.

Safe harbour

We do not yet publish a safe harbour statement. The wording has been settled with our advisers and is awaiting signature; it is not an open question, only an unsigned one, and we will publish it here as soon as it is signed.

Until then: we ask you to report privately and give us reasonable time, and we will not treat a good faith report made under the terms above as a hostile act. That is a statement of intent on this page rather than the authorisation a safe harbour clause gives, and you should weigh it as such. If you want to know whether a particular action would be covered, ask us before you take it — we will answer, and we will treat a question asked in good faith as evidence of good faith.