Skip to main content

Report a vulnerability

Thank you for helping keep ID PASS DataCollect and the people whose data it holds safe. This page describes how to report a vulnerability privately.

Do not open a public issue

Never report a suspected vulnerability through a public GitHub issue, pull request, discussion, or any other public channel. Public disclosure before a fix is available puts live deployments — and the beneficiaries whose data they hold — at risk.

When to use this​

Use the private disclosure channel for anything exploitable that is in scope below — when you are not sure whether a behavior is exploitable, report it privately and let us assess.

Use the public issue tracker instead for known, documented limitations and non-security bugs (for example, a feature that is disabled by default, or hardening an operator is expected to configure). These are not vulnerabilities.

Before you start​

Have the following ready. It lets us reproduce and triage quickly:

  • The affected version, release tag, or commit SHA.
  • The configuration shape involved — for example the external-sync adapter type (OpenSPP V1/V2, OpenFn), authentication mode (JWT, OTP, National ID, OIDC), and whether self-service or scoped sync is enabled.
  • Reproduction steps, as minimal as you can make them.
  • The observed impact and what you would have expected instead.
Never include real secrets or beneficiary data

Do not attach or paste live credentials, bearer tokens, API keys, private keys, or real household/individual records. Reproduce with synthetic data and redact anything sensitive. If a secret was exposed, describe where it leaks — do not include its value.

How to report​

  1. Preferred — GitHub private vulnerability reporting. Open a private report from the repository's Security tab, or directly at github.com/idpass/idpass-data-collect/security/advisories/new. This keeps the report, the discussion, and the eventual advisory in one private place.
  2. Fallback — email. If you cannot use GitHub, email security@acn.fr with the subject [SECURITY] DataCollect - <brief description>.
  3. Include the items from Before you start.

We will acknowledge your report within 2 business days and follow the coordinated disclosure process described in the Security overview.

What is in scope​

Reports that demonstrate one of the following in a supported version are in scope:

  • Authentication or authorization bypass — obtaining access or a role you should not have.
  • Cross-tenant access — reading or writing another program's entities, events, or configuration.
  • Horizontal access on entities — acting on group members or records outside your granted scope.
  • Event or audit integrity failure — forging events, or bypassing the hash-chain tamper-evidence of the event store.
  • Sync integrity — injecting server-managed identifiers, or causing an adapter to push or pull data across the wrong tenant or external record.
  • Secret or credential disclosure — secrets, tokens, or connection details exposed in public configuration artifacts, API responses, logs, or error messages.
  • Beneficiary-data exposure — any leak of household or individual PII to an unauthorized party.
  • Token verification flaws — accepting improperly signed, expired, or wrong-audience tokens (including OIDC on sync routes).
  • Injection & traversal — SQL injection, path traversal, or SSRF (for example via an external-sync URL or an uploaded attachment).

What is not in scope​

These are handled as normal issues or product decisions, not vulnerabilities:

  • Behavior of features that are disabled by default (for example self-service, which ships off, or scoped sync, which is opt-in), unless you can show it is reachable in the default configuration.
  • Documented limitations and deployment hardening that is the operator's responsibility (TLS termination, secret rotation, firewalling, rate-limit tuning).
  • Findings that require an already-trusted administrator acting maliciously against their own tenant.
  • Vulnerabilities in third-party dependencies with no demonstrated exploit path through DataCollect — please report those upstream (we still want to hear about it if you find a path).
  • Reports from automated scanners without a demonstrated, reproducible impact.

If something sits on the line, report it privately and we will make the call together.