Security policy

What this policy covers

This policy covers the VerySafe EUDI Verifier, made by LimogiAI Solutions Inc:

• the hosted service at verify.verysafe.id;
• the self-hosted edition: the image ghcr.io/limogiai/eudi-verifier and the install kits that come with it.

Reporting a vulnerability

Email admin@limogi.ai. Please tell us:

• what is affected: the hosted service, or a self-hosted version and how it is configured;
• how to reproduce it, and what an attacker gains;
• whether you know of it being exploited;
• whether, and how, you would like to be credited.

How to test

Use the EU's test credentials, never a real person's data. Test intrusively only against your own installation; without a licence, the self-hosted edition runs as a sandbox. On verify.verysafe.id, do nothing that slows the service down or reaches another customer's data.

What happens next

1. We confirm we have your report, and tell you who is handling it.
2. We check it, and tell you whether we agree and how severe we think it is.
3. We fix it. The hosted service gets the fix as soon as it is made; self-hosted customers get it in a new release.
4. We tell the customers it affects what to do.
5. Once the fix is out, we publish an advisory: what was affected, which versions, how severe it is, and how to fix it. We credit you, if you wish.

Please keep the details private until the advisory is out; we agree its date with you. How quickly each step happens is not set yet.

Where EU law requires it, we also report an actively exploited vulnerability, or a severe incident, to the EU's cybersecurity authorities. The Cyber Resilience Act gives us 24 hours for a first warning.

Which versions get fixes

A fix ships in a new release. Older releases are not patched today.

Not ours to fix

Problems in the EU's own systems (the trusted lists, the reference wallet and issuer), or in a wallet, belong to their makers. Tell us anyway if one affects our verdicts, and we will help you reach them.

Advisories

Advisories are published on this site, and each one also as a CSAF 2.0 document that security tools can read.

See the advisories