Vulnerability Management Procedures
How potential vulnerabilities are received, prioritised, corrected and checked.
Identification and intake
Potential vulnerabilities may be identified through development reviews, testing, dependency advisories or reports from users and researchers. Record the affected component, relevant version or change, evidence and potential impact. Reports must not contain real customer data where a minimal, non-sensitive example can demonstrate the issue.
Validation and risk assessment
Validate the reported behaviour and assess exploitability, exposure, required access and the effect on customers. Give priority to issues involving unauthorised access, cross-company data exposure, compromised credentials or active exploitation. Reassess priority when new evidence becomes available.
Remediation
Choose a correction or temporary mitigation proportionate to the risk. Assign responsibility, track the issue and review changes for side effects. Where a third-party component is involved, consider available security updates, configuration changes or removal of the affected capability. Do not treat an unverified workaround as a completed fix.
Verification and closure
Verify that the correction addresses the original issue and does not introduce an obvious regression. Record the outcome and any remaining limitations. Close the issue only when the correction or accepted mitigation has been checked. Reopen the investigation if later evidence shows that the risk remains.
Responsible reporting
Use our contact channel to report vulnerabilities privately and allow coordination before public disclosure. Do not access another customer's information, disrupt the service or continue testing after discovering unintended access. This policy is not authorisation for intrusive testing and does not establish a bug-bounty reward programme.
Security questions and reports
Contact XtraCRM about a suspected security issue or a question about these policies. Include a brief description and the affected service; do not include passwords, access tokens or unnecessary personal information.
Contact XtraCRM →