Product security

Soltea develops, distributes and maintains software for its customers. We handle vulnerabilities in our products in accordance with Regulation (EU) 2024/2847, the Cyber Resilience Act: we check our software components every day, fix issues without delay and publish the fixes in the release notes of our products.

This page covers in particular our Sambha2 and DieFeed products (the DieFeedApp Android app and the DieFeedWeb web application). Reports about other Soltea software or services, including this website, are welcome as well.

Write to security@soltea.it, in English or Italian. To help us understand and reproduce the issue, please include where possible:

• the affected product and version;
• a description of the issue and its possible impact;
• the steps to reproduce it, and a proof of concept if available;
• how we can contact you, and whether you would like to be credited.

Please do not send personal data of third parties or our customers’ data: if you obtained any during your research, describe the type of data without attaching it.

• We acknowledge your report within 5 working days.
• We assess the issue and keep you informed about the outcome and the expected time to fix.
• We fix vulnerabilities with a priority proportionate to their severity and release security updates free of charge.
• Once a fix is available, we describe it in the security notes of the release and, if you wish, credit you for the report.
• If a vulnerability is actively exploited, we notify the competent authorities (CSIRT Italia and ENISA) as required by the Cyber Resilience Act and inform affected users about the measures to take.

We ask you not to disclose details of the vulnerability until a fix is available, or until a date agreed with us. We normally ask for up to 90 days from the report; the period is shortened if the vulnerability becomes public or is exploited.

We consider research to be in good faith, and will not take legal action against anyone who follows these rules, when it:

• is carried out on your own installations or accounts, or on systems you are authorised to test, and not on our customers’ production systems;
• does not access, modify or delete other people’s data beyond what is strictly necessary to demonstrate the issue;
• does not degrade or disrupt services (no denial-of-service testing) and does not use social engineering, phishing or physical access;
• reports the issue to us without delay and deletes any data obtained.

Unless a concrete impact is demonstrated, we do not consider the following to be vulnerabilities: unverified automated scan results, missing HTTP headers, SPF/DKIM/DMARC configuration, clickjacking on pages without sensitive actions, denial-of-service attacks.

We do not currently offer monetary rewards.

Fixed vulnerabilities are described in the “Security notes” section of each product’s release notes: for every release they list the vulnerabilities fixed (CVE or description), the updated component, the severity and the version to install. Versions earlier than a release with security fixes should be considered potentially affected. Vulnerabilities that are not yet fixed are not published.

• DieFeedWeb: DieFeedWeb release notes, “Security fixes” section of each release.
• DieFeedApp: “What’s new” section of the app’s Google Play listing; details are in the DieFeedWeb release notes.
• Sambha2: CHANGELOG file included in the installation package, also sent to the customers who installed it.

We thank everyone who helps make our products more secure by reporting vulnerabilities responsibly. Reporters who wish to be credited are named in the security notes of the release containing the fix.

Our security contacts are also published in the security.txt file, following the RFC 9116 standard, on this website and on our product websites.