Responsible Disclosure Policy

IDJÉ publishes what it measures, and publishes without seeking the provider's permission. This policy does not open exceptions to that. It defines the one situation in which IDJÉ waits before publishing, an exploitable security flaw in a system in use, and the maximum length of that wait.

Outside that situation, nothing is withheld, delayed or softened.

A vulnerability is a flaw that allows a third party to bypass a safeguard of the system or to compromise the confidentiality, integrity or availability of the system and its data. This category includes a reproducible jailbreak, a prompt injection that bypasses a filter, extraction of training data or of third-party personal data, and any other flaw that allows a safeguard to be bypassed or something the system should protect to be exposed.

A compliance finding is not a vulnerability. Bias, stigma, excessive refusal, declared political position, the other forms of social harm IDJÉ measures: these follow the normal course of publication, with no prior notice and no waiting, because they are the object of the laboratory's measurement. Without that distinction, the responsible disclosure policy would operate as a veto over the work the laboratory exists to do.

Classification is IDJÉ's. A provider has no power to frame a finding as a vulnerability in order to obtain time. A disagreement over classification is recorded with the case and does not change the deadline or the publication date.

On finding a vulnerability that is not yet public, IDJÉ notifies the provider in writing, with enough detail to reproduce and fix the problem, and keeps a channel open during the period set out in item 04.

Where the same flaw evidently affects other providers, IDJÉ notifies them too, to the extent it can do so without revealing information that would increase the risk.

IDJÉ publishes within 60 days of the notice, even if the flaw has not been fixed. That is the ceiling, and it is not extendable for convenience.

A written agreement for a longer withholding period holds within the limit of 120 days, with a defined end date, and is disclosed in the publication together with the reason.

Where the provider offers no safe harbour at all against retaliation, whether legal, commercial or in access, IDJÉ has no obligation to give prior notice and publishes.

Operational detail of an information hazard, in cases where disclosure would cause more harm than benefit: synthesis of biological, chemical, radiological or nuclear material, and child sexual abuse material. Third-party personal data, active credentials and user data are also not published. When IDJÉ redacts something, it says that it redacted and says why.

The withholding provided for in this item is reviewed once a year and holds for as long as the risk of disclosure outweighs the benefit. If the risk falls, the withholding falls, and IDJÉ publishes what was withheld with a note on what changed. Withholding without a review date amounts to permanent withholding, which is another matter entirely.

Compliance findings, bias, a safeguard flaw after the deadline in item 04 has passed, excessive refusal, and any result that goes against the interest of the evaluated provider.

No agreement gives a provider the right to review in advance, to edit, to block or to delay publication because of the content of the result. A provider may disagree publicly, and disagreement is welcome. The published text remains IDJÉ's.

Every case of withholding is recorded with the date of the finding, the date of the notice, the provider's response, the period applied, the publication date and what was redacted.

The number of cases and the average withholding time are reported in IDJÉ's annual report. Recorded withholding is procedure; invisible withholding is private censorship.

The person who decides to withhold publication is the same person who signs the conflict of interest declaration for the evaluation, and the decision is recorded alongside it.

Where the provider of the withheld flaw is also a funder, the case is treated as a conflict of interest rather than as a technical decision. The conflict of interest policy does not permit that funding.

Providers who wish to discuss a flaw, request time or contest a finding use the contact address published on this website. IDJÉ replies in writing, and the reply enters the record in item 07.