Renoolab Fr Vulnerability Disclosure

generated: '2026-09-19'
method: searched
probe: true
source: https://github.com/mehdimicra/renoolab-mcp/blob/main/SECURITY.md
sources:
- https://github.com/mehdimicra/renoolab-mcp/blob/main/SECURITY.md
- https://github.com/mehdimicra/renoolab-agent-skills/blob/main/SECURITY.md
- https://renoolab.fr/support/ ("Sécurité et modération")
probe_result: probe-security-programs.py found no security.txt on any host and no disclosure page on renoolab.fr (vdp=none trust=none)
policy:
- https://github.com/mehdimicra/renoolab-mcp/blob/main/SECURITY.md
- https://github.com/mehdimicra/renoolab-agent-skills/blob/main/SECURITY.md
contact:
- support@renoolab.fr
- contact@renoolab.fr
bug_bounty: false
bug_bounty_note: '"No public bug-bounty program is promised by this policy." (renoolab-mcp SECURITY.md)'
security_txt: false
scope: 'the remote MCP endpoint https://mcp.renoolab.fr/mcp and its OAuth surface (renoolab-mcp policy); the Agent Skills collection (agent-skills policy)'
safe_harbor: not stated
testing_rules: 'read-only searches only; no contact requests or accounts for testing without prior written authorization; no DoS, social engineering, data extraction or testing against real users; never include credentials, OAuth tokens, personal data or live contact details in a report'
report_contents_requested: [affected URL or MCP method, concise reproduction, expected vs observed behaviour, potential impact, non-sensitive logs or screenshots]
response_commitment: '"RenooLab will acknowledge and triage the report as soon as reasonably possible."'
evidence:
- {source: 'https://github.com/mehdimicra/renoolab-mcp/blob/main/SECURITY.md', kind: security-policy, http_status: 200, fetched: '2026-09-19', keywords: [security policy, reporting a vulnerability, support@renoolab.fr, bug-bounty]}
- {source: 'https://github.com/mehdimicra/renoolab-agent-skills/blob/main/SECURITY.md', kind: security-policy, http_status: 200, fetched: '2026-09-19', keywords: [problème de sécurité, contact@renoolab.fr]}
- {source: 'https://renoolab.fr/.well-known/security.txt', kind: security.txt, http_status: 404}
- {source: 'https://mcp.renoolab.fr/.well-known/security.txt', kind: security.txt, http_status: 404}
note: >-
  The disclosure policy lives in the two first-party GitHub repositories, not on renoolab.fr and not as an
  RFC 9116 security.txt. It is a real, published, first-party channel with reporting rules and a named
  mailbox, so it is recorded (and a Security pointer emitted) with the caveat that a visitor to the website
  itself would not find it - the support page only says to mention "modération" for abuse and never to send
  passwords or OAuth tokens by e-mail.