Security
Netscope is a tool for people who audit networks for a living, so it is reasonable to expect us to be able to answer this question. Here is what we do, and how to tell us when we have got something wrong.
Reporting a vulnerability
Email security@netscope.fr with enough detail to reproduce the issue. We acknowledge within 72 hours, tell you our assessment within 10 working days, and keep you updated until it is fixed. Please give us 90 days before publishing, and we will credit you when we announce the fix unless you would rather we did not.
What we do
Credentials
- Passwords hashed with bcrypt at cost factor 12 — never stored or logged in clear
- A 12-character minimum with mixed character classes, enforced in one place server-side
- API keys, password-reset tokens, verification tokens and recovery codes stored only as SHA-256 hashes
- Sign-in lockout after repeated failures, and a per-account cooldown on every email we send
Authentication
- Two-factor authentication with an authenticator app, a security key (WebAuthn/FIDO2) or an emailed code
- Ten single-use recovery codes, accepted as a fallback for every factor
- Short-lived access tokens with rotating refresh tokens; a reused token revokes every session for that account
- Re-authentication required for destructive actions — deleting an account, changing a password, removing a factor — not just a live session
- Optional single sign-on with Google, GitHub and Microsoft, which never links an account on an address the provider has not verified
Your data
- TLS on every connection; device descriptions encrypted at rest with AES-256
- Cross-organisation access denied by default through a single authorisation layer
- A resource you cannot see answers the same way whether or not it exists, so ids cannot be probed
- Twenty tenant-isolation scenarios in an automated suite that runs on every change
Infrastructure
- Hosted in France; data and backups do not leave the European Economic Area
- Default-deny firewall, key-only SSH with passwords and root login disabled, automatic security updates
- Deployment credentials confined by a forced command to one directory and one action
- A database dump taken before every deployment, with an automated health check and rollback
- Automated dependency updates and vulnerability scanning in CI
Scope
In scope: netscope.fr, www.netscope.fr, api.netscope.fr, dashboard.netscope.fr, and the Netscope agent.
Please do not: run denial-of-service or volumetric tests, use automated scanners that degrade the service for others, attempt social engineering against us or our providers, or access, modify or delete data belonging to anyone else. Use your own account and your own test data. Stay within those lines and we will not pursue you for a good-faith report.
We do not run a paid bug bounty. We are a small team and would rather be honest about that than imply a reward we cannot pay.
Breaches
If a breach affects personal data and is likely to put anyone's rights at risk, we notify the CNIL within 72 hours of becoming aware, and affected people directly where the risk is high. Customers whose data we process are told within 48 hours so they can meet their own obligations. See the Privacy Policy and the Data Processing Agreement.