Quarantine and anti-abuse defences
The reporting form is the only surface that accepts content from strangers, attachments included. It is protected at several levels, guided by one principle: a genuine report must never be lost, not even when a defence cannot make up its mind.
The layers
| Layer | How it works | If it triggers |
|---|---|---|
| Rate limit | Submissions counted per source address, over a short window and per day. | «Too many reports from this address, try again later». |
| Honeypot field | A hidden field a human cannot fill in. | Submission discarded silently, behind a plausible thank-you page. |
| Minimum time | A server-signed marker measures the time between opening and submitting. | An instantaneous submission is discarded silently. |
| Anti-bot check | Cloudflare Turnstile, where configured on the installation. | An invalid token means the submission is refused with an explicit message. |
| Content limits | Description between 10 and 5000 characters, a valid or empty email, an overall size cap. | An error on the page, with the text preserved. |
| Quarantine | The signal stays unpromoted (INCOMING). | It does not become a case or enter the dossier until a person reviews and promotes it. |
When the anti-bot check is unreachable
If the verification service does not answer because of a network problem, the submission is accepted and the signal is marked «turnstile non verificabile» in the registry. This is deliberate: losing a genuine report is worse damage than a spam signal that stays unpromoted anyway. A token that is present but invalid is a hard refusal.
Untrusted attachments
Files arriving through the public form are treated as hostile until proven otherwise:
- they are stored separately and marked unverified;
- they are never rendered inside the page: they are downloaded only, with a content type that prevents execution in the browser;
- they are reachable only by authenticated users of your organisation, never from a guessed address;
- the declared extension is not trusted: the real type is detected from the content and disallowed formats are dropped.
Open them in an isolated environment. A report attachment is, by definition, a file somebody built to show you that something breaks.
If an attachment is dropped for format or size, the rest of the report still comes through: the text is not lost because of one file.
Pre-screening
While the signal stays unpromoted (INCOMING) there are three actions: promote it to a case, attach it to an existing case, or dispose of it (duplicate, informational or dismiss). Screening answers three questions:
- Is it pertinent? Does it concern one of your products and have security relevance, or is it a support request in disguise?
- Is it intelligible? Is there enough to understand what is being described, or does the reporter need to be asked for clarification?
- Is it a duplicate? If so, attach it to the existing case.
A disposal preserves its justification: choosing not to handle a report is a recorded decision too.
Good practice. Review every signal within a few working hours. A signal starts no statutory clock until it is promoted to a case; but at promotion the moment of awareness is set explicitly and may indicate an earlier instant — when the organisation genuinely learnt of it. Delaying the review buys no time.
Reporter data
The contact address is optional. If absent, the signal reads «not provided (anonymous)». The reporter only sees a generic received screen: no automatic acknowledgement and no public tracking number. If the address is present, it is used only for an optional human follow-up: it feeds no lists and no marketing. The processing is described in the privacy notice.
Isolation between organisations
Each form is bound to a single organisation through the code in its address. A non-existent code returns «not found» — you cannot discover which organisations exist by trying addresses. Reports are visible only to users of the receiving organisation.