Security

Security and responsible disclosure

If you believe you have found a security vulnerability in one of our websites or services, please tell us. We will work with you to understand and fix it.

Last updated: 24 October 2026

1. How to report a vulnerability

Email security@globalitfirm.net. We read reports in English and French. Please include:

  • the address (URL), host or service affected;
  • a description of the vulnerability and its possible impact;
  • the steps needed to reproduce it, with screenshots or a proof of concept if you have them;
  • how we can contact you, and whether you would like to be credited.

Please do not report a vulnerability through public channels, social media or the website contact forms. Our contact details are also published in machine-readable form at /.well-known/security.txt.

2. Scope

This policy covers globalitfirm.net and its subdomains.

The following are out of scope:

  • systems and services run by third parties, such as our hosting, email and payment providers, even when they serve one of our domains. Please report those to the provider concerned;
  • denial-of-service attacks, load or stress testing, and spam;
  • social engineering or phishing of our staff, clients or partners, and physical attacks on our offices or sites;
  • findings without a demonstrable security impact, such as missing best-practice headers on their own or the results of automated scanners that have not been verified.

3. Rules for testing

  • Do not run any test that degrades, interrupts or slows down our services or our clients' services.
  • Only access the minimum data needed to show the vulnerability. If you reach personal data, credentials or client information, stop, do not copy or keep it, and tell us straight away.
  • Do not modify or delete data, and do not keep access longer than needed to confirm the issue.
  • Use only accounts you own or have permission to use, and do not try to access other people's accounts.
  • Keep the details of the vulnerability confidential until it is fixed, and agree a disclosure date with us before publishing anything.
  • Follow the laws that apply to you.

4. What we commit to

  • We aim to acknowledge your report within 5 business days.
  • We will assess the report, keep you informed of our progress and tell you when the issue is fixed.
  • We will handle your report and your contact details confidentially and will not share your personal details without your permission.
  • If you wish, we will credit you once the issue is resolved.

This policy does not offer payment or rewards for reports.

5. Safe harbour

If you act in good faith and follow this policy, we will consider your research authorised, we will not take or support legal action against you for it, and we will not report you to law enforcement. If a third party takes legal action against you for research that complied with this policy, we will make it known that your actions were authorised by us. This safe harbour covers only our own systems; we cannot authorise testing of systems that belong to third parties.

If you are unsure whether a test is allowed, ask us first at security@globalitfirm.net.

6. Other reports