Security policy

Since founding ébewè in 2011, I have written all my code in line with coding and security rules, to give my clients clean, efficient and safe code.

That is why it seems obvious to me today to strengthen the security of my PrestaShop modules further by joining the programme set up by TouchWeb: the Charter for responsible cybersecurity.

Reporting a vulnerability

The security of my modules and my clients comes first. That is why I encourage security researchers to analyse my modules and report any vulnerability they find, in line with good responsible disclosure practice.

I undertake to identify and fix any vulnerability, and to communicate transparently with the parties concerned throughout the process.

If you think you have found a vulnerability in one of my modules, you can report it responsibly at: contact@ebewe.net

Please give me as much detail as possible (description, impact, affected version, steps to reproduce).

Please note that findings that cannot be reproduced, or that are not directly related to my modules, will be ignored.

My vulnerability management policy

In accordance with the TouchWeb Charter for responsible cybersecurity, I apply the following principles:

• Acknowledgement of any relevant report within 7 days at most. (CVSS ≥ 6.5)
• Impact analysis and fix planning within 30 days at most.
• Publication of a security advisory with a CVE if the CVSS score is ≥ 7.5.
• No fix will be published silently.

Alongside this, I make the following commitments to ensure responsible and ethical handling of vulnerabilities:

• Not to prosecute researchers acting in good faith, in particular under the YesWeHack programme run by TouchWeb SAS.
• To ensure that no confidentiality agreement, including white-label agreements, can hinder the transparent publication of a security advisory with a CVE identifier, in line with the state of the art.

I am well aware that this transparency is essential for third parties (agencies, merchants, etc.) to meet their compliance obligations, in particular under the PCI-DSS standard or one of its lighter versions, such as SAQ-A.

Publication authorisation

I expressly authorise TouchWeb SAS to publish information about fixed vulnerabilities in my modules on its official website, in accordance with the commitments of the Charter for responsible cybersecurity.

This publication includes:

• A CVE identifier for the vulnerability.
• A security note clearly describing the problem and its resolution.
• The affected versions and the fixed version.
• An easy-to-deploy fix when updating is not possible.
• Any useful information that helps users and agencies protect themselves quickly.

TouchWeb Charter for responsible cybersecurity

Publications