Vulnerability disclosure policy
If you think you have found a vulnerability in Walkie Desk, we want to know. This page explains how to report it and what you can expect from us.
How to report
- Use the Report form and choose “A vulnerability”;
- or write to security@walkiedesk.app.
We do not publish a PGP key at the moment: if you need an encrypted channel to send us the details, write to us and we will agree on one. We read reports in Italian and English.
What to include
- the component (for example Walkie Desk for Windows, QuickSupport, user area, API) and its version;
- a description of the problem and its impact;
- the steps to reproduce it and, if available, a proof of concept;
- how to contact you and whether you want to be credited in the advisory.
Do not send us personal data of other people you may have seen during your tests.
Scope
In scope
- Walkie Desk for Windows: setup, service, session program and tray app;
- QuickSupport;
- the user area and the in-browser viewer (walkiedesk.app/app/);
- the APIs and signaling (walkiedesk.app/v1/);
- the coordination server, the relay server (turn.walkiedesk.app) and the walkiedesk.app website.
Out of scope
- denial-of-service attacks and tests that degrade the service for other users;
- social engineering of iDev staff or users, physical attacks;
- already public vulnerabilities in third-party software without a demonstrated impact on Walkie Desk (report them to the vendor);
- automated scanner output without proof of impact;
- missing headers or settings without a concrete impact.
Testing rules
- Use only your own accounts and PCs, or those you are authorised to test.
- Do not access, modify or delete other people’s data: if you come across any, stop and report it to us.
- Do not degrade the service and do not send spam.
- Do not disclose the vulnerability before it is fixed or before the date agreed with us.
Indicative timelines
- Acknowledgement of receipt
- within 5 working days
- Initial assessment
- within 10 working days
- Fix for severe vulnerabilities
- within 90 days of the report
We keep you informed about the status of your report and agree with you when to make it public. After the fix we publish a security advisory.
Good faith
If you report a vulnerability to us in good faith and follow this policy, we will not take legal action against you for your research and will not ask the authorities to do so. If a third party takes action against you for activities carried out in line with this policy, we will make it known.
Credit
If you wish, we credit you with the name or pseudonym you prefer in the security advisory for the fix. Credit is optional. We do not offer monetary rewards (bug bounty).
This policy is part of Walkie Desk’s vulnerability handling under Regulation (EU) 2024/2847 (Cyber Resilience Act). The machine-readable reference is security.txt. How we process report data: privacy notice.