SECURITY / RESPONSIBLE DISCLOSURE
Help us keep
ITC plugins safer.
If you discover a security issue in an ITC plugin or itouchcode service, report it privately so we can investigate and fix it.
What to include
Share a concise description, affected product and version, impact, and steps to reproduce. A small proof of concept is helpful when safe. Do not include real customer data, credentials, or destructive payloads.
Coordinated disclosure
Please give us a reasonable opportunity to investigate and prepare a fix before publicly disclosing a vulnerability. Do not access or alter data belonging to other people, interrupt services, or test beyond what is necessary to demonstrate the issue. We will acknowledge reports and communicate about remediation as we are able; no response or fix timeframe is guaranteed.
Updates and advisories
Security fixes will be distributed through the normal product update channel and described in the public changelog when it is safe to do so. We do not claim that any software is free of vulnerabilities.
The EU Cyber Resilience Act’s reporting obligations apply from 11 September 2026, with its main obligations applying from 11 December 2027. We are reviewing the obligations that apply to ITC Forms and will use the ENISA Single Reporting Platform where required. This information is not a statement of legal compliance.