If you think you have found a security issue in an Edilec website, product or service, email security@edilec.com. Include the affected URL or component, the steps to reproduce it and the impact you believe it has. We acknowledge reports within one business day and keep you updated until the issue is fixed. Our full policy is on the Security page.
Where to report
Send reports to security@edilec.com. The same address is published in our security.txt file at https://edilec.com/.well-known/security.txt, the standard location defined by RFC 9116 that security researchers and tools check first. Please use this address rather than general contact forms or social media, so the report reaches the people who can act on it.
What to include
- The affected URL, product or component.
- Clear steps to reproduce the issue, including any requests, parameters or settings involved.
- What you believe the impact is: what an attacker could see, change or do.
- Screenshots or a short recording if they help, with any personal data removed.
- How you would like to be credited, or that you prefer not to be.
What is in scope
| In scope | Out of scope |
|---|---|
| edilec.com | Denial of service |
| uynis.com | Social engineering of Edilec staff |
| The Edilec client portal | Physical attacks on offices or equipment |
Ground rules for good-faith research
- Do not access, change or delete data that is not yours. If you reach someone else's data, stop and tell us.
- Do not disrupt our services or degrade them for other users.
- Do not share the issue publicly before it is fixed.
- Give us a reasonable time to fix the issue before discussing it.
What happens after you report
| Step | What we do |
|---|---|
| Acknowledge | Reply within one business day to confirm we received the report |
| Assess | Reproduce the issue, assess its severity and decide on the fix |
| Fix | Fix the cause and check the fix |
| Update | Keep you informed until the issue is resolved |
| Close | Confirm the fix and, if you wish, credit you |
Why a disclosure policy matters
A published disclosure policy tells researchers that reports are welcome, gives them a safe way to send them and sets fair expectations on both sides. International standards such as ISO/IEC 29147 and public templates such as the one from the US Cybersecurity and Infrastructure Security Agency describe the same building blocks we follow: a clear contact, a defined scope, ground rules and a commitment to respond.
If your own organization needs a disclosure policy or a security.txt file, or wants its systems tested, see Penetration Testing and Red Team Services.
