Openmercantil Vulnerability Disclosure

generated: '2026-08-14'
method: searched
source: https://openmercantil.es/seguridad
docs: https://openmercantil.es/seguridad
provider: OpenMercantil
providerId: openmercantil
description: >-
  OpenMercantil publishes a responsible-disclosure policy in prose on its
  technical security page, with a named contact, an acknowledgement SLA and
  CVSS-banded remediation targets. It does NOT serve
  /.well-known/security.txt, and it runs no bug bounty program.
program:
  published: true
  type: responsible-disclosure
  bug_bounty: false
  bounty_platform: null
  policy_url: https://openmercantil.es/seguridad
  contact_page: https://openmercantil.es/seguridad
  contact_email: >-
    Published on the security page behind the site's email-obfuscation script;
    the subject line "Security disclosure" is specified. The page's other
    published contacts are hola@openmercantil.es (general),
    privacidad@openmercantil.es (GDPR) and rectificacion@openmercantil.es
    (data corrections).
  subject_line_required: 'Security disclosure'
  acknowledgement_sla_hours: 72
  coordinated_disclosure_requested: true
  researcher_credit: >-
    Public acknowledgement of the researcher in the changelog is offered, at
    the researcher's option.
  safe_harbor_stated: false
remediation_targets:
  - severity: critical
    cvss: '9.0-10.0'
    temporary_mitigation: within 24 hours
    permanent_patch: within 7 days
  - severity: high
    cvss: '7.0-8.9'
    permanent_patch: within 14 days
  - severity: medium
    cvss: '4.0-6.9'
    permanent_patch: next monthly release cycle
  - severity: low
    cvss: '<4.0'
    permanent_patch: documented and prioritised
security_txt:
  served: false
  probed_paths:
    - url: https://openmercantil.es/.well-known/security.txt
      status: 404
  note: >-
    A documented disclosure policy with a stated 72-hour acknowledgement and
    CVSS-banded targets exists but is not machine-discoverable. Mirroring it to
    /.well-known/security.txt per RFC 9116 is the single cheapest improvement
    available on this provider's security surface.
published_controls:
  transport:
    - HTTPS enforced site-wide
    - 'HSTS max-age=31536000; includeSubDomains (preload not yet submitted)'
    - TLS 1.2+ with modern ciphers; no RC4, 3DES, MD5 or SHA-1
    - Content-Security-Policy with explicit allowlist
    - 'X-Frame-Options: SAMEORIGIN, X-Content-Type-Options: nosniff'
    - 'Referrer-Policy: strict-origin-when-cross-origin'
    - Permissions-Policy denying geolocation, camera and microphone
    - Certificate via OVH AutoSSL (Let's Encrypt), auto-renewed 30 days before expiry
  at_rest:
    - SQLite database with UNIX 600 permissions
    - 'Passwords hashed with bcrypt (password_hash, cost 12); never logged in clear'
    - 'API tokens and session ids from random_bytes() CSPRNG, minimum 32 bytes / 256 bits'
    - Daily backups encrypted with AES-256-GCM before leaving the server, 30-day rotation
    - Card data never stored — Stripe Checkout and Customer Portal only
  access_control:
    - Email + password or Google Sign-In
    - Passwords checked against HaveIBeenPwned on change
    - Exponential lockout after 5 attempts on login, password reset and API key request
    - 'Session cookies HttpOnly, Secure, SameSite=Lax; 4h idle expiry, 30d if remembered'
    - CSRF tokens on every state-changing form
    - Admin access restricted by IP allowlist plus mandatory TOTP 2FA
  pipeline_integrity:
    - Every processed BORME act retains the original official PDF URL
    - SHA-256 of each downloaded PDF compared against the AEBOE-published hash
    - Daily cron is idempotent — reprocessing a day yields the same result
    - Versioned schema migrations (0001..0028) with documented rollback
  privacy:
    - IP addresses anonymised in persisted logs (final octet zeroed)
    - Technical logs retained 30 days; security audit logs up to 1 year
    - No third-party advertising trackers beyond consented GA4/Clarity
    - No sale or transfer of personal data
deliberately_declined:
  - Third-party tracking services beyond consented GA4 and Microsoft Clarity
  - AI models inferring undeclared characteristics from personal data
  - Selling or transferring company or natural-person lists
  - Storing card data at any point
  - Dark patterns in cookie consent or plan upgrades