Do you think you have found a security vulnerability in MBI Clone, its servers or this website? Here is how to tell us, and what we do next.
How to contact us
- By email:
This email address is being protected from spambots. You need JavaScript enabled to view it. , in French or English. - By telephone: +33 3 89 65 90 45 (03 89 65 90 45 from France), on working days.
- The contact form is suitable for a first message, without technical details.
We do not yet have a public encryption key. If your report contains a sensitive detail, say so in your first message: we will agree on a way to exchange information in encrypted form. Do not include any personal data.
What is covered
- The MBI Clone software, its installer and its updates.
- The servers the software needs: activation and licences, updates, software packs, shared readings, submission of diagnostic reports.
- The customer area, this website and its subscription page.
Services from other companies that we use (payment by Stancer, email from Google, hosting by OVH, email delivery by Postmark), Windows itself and the software installed by WinGet should be reported to their publisher.
What helps us
The version of MBI Clone (“About” page) and of Windows, what is affected, the steps to reproduce the issue, what an attacker could obtain, and a minimal proof, without any real customer data. Also tell us how to get back in touch with you, and whether you would like to be thanked publicly.
Our commitments
- An acknowledgement of receipt within 5 working days.
- An initial assessment within 10 working days: whether the vulnerability is confirmed, and how severe it is.
- A fix, as a guide, within 30 days for a critical or high-severity vulnerability, within 90 days for a medium-severity one, and in an upcoming version for a low-severity one.
- News at each stage, and at least every 30 days until the vulnerability is fixed.
A vulnerability that is already being exploited takes priority over everything else. We also report it to the authorities, as provided for by the EU Cyber Resilience Act.
During your research
We ask you not to access another customer’s data, not to modify or keep it, and to stop as soon as any third party’s data appears; not to degrade the service (no denial-of-service testing, no mass sending); not to use social engineering or physical intrusion; and not to publish anything before the fix, or before 90 days after your report if we have not agreed on another date.
Publication and acknowledgements
When the fix is available, we publish a security advisory: affected versions, fixed version, severity and what users need to do, without any detail that would help to exploit the vulnerability. The date is agreed with you; it may be postponed to give users time to install the fix. With your agreement, we thank you in it.
A vulnerability in a component from another publisher included in the software, such as the .NET runtime or the openSeaChest tools, is also passed on to that publisher.
For automated tools
This information is also published in the standard security.txt format, at mbiclone.com/.well-known/security.txt. Data from reports is processed as described on the Privacy page.