Skip to content
folhas.io
secure by design for connected products· coordinated disclosure

Coordinated disclosure policy

If you have found a vulnerability in one of our systems, we want to know. This page sets out what is in scope, how to get the report to us and what you can expect from us.

Scope

This site, folhas.io, and the public repositories of Folhas Etéreas. Aeromate, the product we are developing, comes into scope once it is on the market, and this will be its channel.

Third-party systems are out of scope. A flaw in the hosting platform (Cloudflare) should be reported through Cloudflare's own programme.

How to report

By email, to oi@folhas.io. It helps to know what you found, where (address or repository, and version), how to reproduce it and what impact you think it has.

To encrypt your message, use the PGP key, valid until 5 Aug 2028, and check the fingerprint before using it:

47F4 8CE0 08B5 D2FA 6586 C4CA E26F 2857 340E 0143

The same details are available in standard form in oursecurity.txt (RFC 9116).

What we do

  • We acknowledge receipt within two working days.
  • We assess the report and tell you what we concluded and what we will do.
  • We keep you informed until the fix and agree the disclosure date with you.
  • If you wish, we credit you in the disclosure, under the name or handle you choose.

What we ask

  • Reasonable time to fix the issue before any public disclosure.
  • That you do not access, alter or remove data that is not yours. If you come across third-party data, stop and let us know.
  • That you do not run tests that degrade the service for people visiting the site.

Limits

We do not run a bug bounty programme. This page describes how we handle the reports we receive: it is not a legal promise ("safe harbour") and does not set aside the applicable law.

The article on coordinated disclosureexplains why the Cyber Resilience Act asks every manufacturer for a channel like this one.

Version of 23 Oct 2026.