Reporting a Vulnerability
The security of our Prestashop modules we develop for our clients is a top priority. That’s why we encourage security researchers to analyze our modules and report any identified vulnerabilities, in accordance with responsible disclosure best practices.
We encourage you to include as much detail as possible in your report:
Essential information to include
→ Detailed description: Clearly explain the nature of the identified vulnerability.
→ Impact assessment: Describe the potential consequences for users or websites.
→ Affected versions: Specify the versions of the module impacted by the vulnerability.
→ Reproduction steps: Provide a step-by-step guide to reproduce the issue.
→ Proof of concept: If possible, include screenshots or relevant code snippets.
Please note that unreproducible findings or issues not directly related to our modules will be disregarded.
We are committed to identifying and resolving all reported vulnerabilities and maintaining transparent communication with all relevant parties throughout the process.
Our Vulnerability Management Policy
In line with the TouchWeb Charter for Responsible Cybersecurity, our team adheres to the following principles:
- Acknowledgment of any relevant report within 7 days maximum. (CVSS ≥ 7.5)
- Impact analysis and patch planning within 30 days maximum.
- Publication of a security advisory with CVE if the CVSS score is ≥ 7.5.
- No fix will be released silently.
In addition, we make the following commitments to ensure responsible and ethical vulnerability management:
- We will not take legal action against researchers acting in good faith, particularly within the YesWeHack program managed by TouchWeb SAS.
- We guarantee that no confidentiality agreement, including white-label ones, will prevent the transparent publication of a security advisory with a CVE ID, in accordance with industry standards.
We fully understand that such transparency is essential to help third parties (agencies, merchants, etc.) meet their compliance obligations, particularly under the PCI-DSS standard or one of its simplified versions, such as SAQ-A.
Publication Authorization
We expressly authorize TouchWeb SAS to publish information regarding patched vulnerabilities in our modules on its official website, in accordance with the commitments of the Responsible Cybersecurity Charter.
This publication includes:
- A CVE identifier associated with the vulnerability.
- A security advisory clearly describing the issue and its resolution.
- The affected and patched versions.
- An easy-to-deploy patch when updating is not feasible.
- Any useful information to help users and agencies quickly protect themselves.
We fully understand that this transparency is essential to help third parties (agencies, merchants, etc.) meet their compliance obligations, particularly under the PCI-DSS standard or one of its simplified versions, such as SAQ-A.
Disclosures
No disclosures at this time.