1. What this covers
This policy covers the cybertenant.ro site and the cyberTENANT platform: the application, the AI agent, the components that collect logs, and the installation packages, in both delivery options. If the vulnerability concerns another certSIGN product or service, send it to the same address; we pass it on to the certSIGN team responsible.
2. How to report
Write to cybertenant@certsign.ro with a subject that starts with “Vulnerability”. You can write in English or Romanian. It helps if your message includes:
- the affected component and its version or, for the site, the page address;
- the steps to reproduce the problem;
- what an attacker could do with the vulnerability, as you see it;
- the evidence: screenshots, the relevant requests and responses;
- how we can reach you, and whether you want to be credited when we publish the fix.
Do not send us other people's personal data or our customers' data. If the details are sensitive, first send a short message without details, and we will agree on an encrypted channel together.
3. What we do once we receive your report
- We confirm receipt within 3 working days.
- Within 10 working days we tell you whether we have reproduced the problem and how severe we consider it.
- We keep you informed until it is fixed and tell you when the fix is ready.
- We agree with you when the details are published. The usual period is 90 days from the report. If the vulnerability is already being used in attacks, we move faster.
- We inform the customers affected and, where the law requires it, report actively exploited vulnerabilities to the competent authorities.
- If you wish, we credit you in the security note that accompanies the fix.
4. Rules for testing
Test only what you are entitled to test: the cybertenant.ro site, and an installation of the platform that belongs to you or that its owner has agreed in writing that you may test. When you test:
- do not run denial-of-service (DoS) attacks or load tests;
- do not send more than a few test messages through the contact form;
- do not attempt social engineering or phishing against certSIGN employees or our customers, and do not attempt to enter our buildings;
- do not access, modify or delete data that is not yours; if you reach such data, stop, do not keep it, and tell us;
- use the vulnerability only as far as you need to demonstrate it;
- do not test our providers' infrastructure (Cloudflare, Microsoft); report what you find there directly to them.
5. Research in good faith
If you follow the rules above, act in good faith and give us time to fix the problem before you publish, we will not file a complaint or take legal action against you for this research. If a third party takes action against you for research done under these rules, we will confirm publicly that you followed our policy.
6. What we do not treat as a vulnerability
- reports generated automatically by a scanner, without a demonstrated problem;
- missing security settings (for example, HTTP headers) without an impact you can show us;
- attacks that need physical access to the victim's device or an already compromised device;
- vulnerabilities in other vendors' products, which you report to their vendor.
We do not run a bug bounty programme, but we will gladly thank you publicly for your report if you wish.
The contact address is also published in the standard security.txt file (RFC 9116).
Last updated: 6 October 2026.