Security and responsible disclosure policy

This English version is a translation provided for convenience only. In the event of any discrepancy, the French version prevails.

Publisher of Halyx: Morgan Sanchez EI (sole trader, entrepreneur individuel), registered name “MONSIEUR MORGAN SANCHEZ”, trading as Halyx. SIREN 852 341 536, SIRET 852 341 536 00021. Registered with the French National Business Register (Registre national des entreprises, RNE). Address: 142 rue de Rivoli, 75001 Paris, France. EU VAT number: FR54852341536.

Security contact: contact@halyxapp.com

1. Purpose

1.1. This document explains how to report a security vulnerability in Halyx to us, and what we do next.

1.2. It also describes our security commitments to users: fixing vulnerabilities, security updates, support period and reporting to the authorities.

1.3. In this document, “we” means the publisher above. “You” means the person who reports a vulnerability or who uses Halyx.

2. Scope

2.1. What is covered

• The Halyx software installed on a computer, in a version published by us: currently for Windows; other versions may be released.
• The Halyx interface opened in a browser, on the computer where Halyx is installed or on another device on the local network (tablet, phone, other computer), including when it is installed as an app.
• Device access to Halyx: access codes, roles given to devices, HTTPS connection.
• The licensing system: verification of the licence on the machine, including offline, machine fingerprint, counting of universes, linking of the licence to the signed-in account.
• The online features of Halyx: account creation and management, licences, machines, gift codes, access to payment and to the subscription management area.

2.2. What is not covered

• Vulnerabilities in the third-party services themselves (for example Stripe, Supabase, Sentry, Google, Anthropic or GDTF Share). Report them directly to those services. If the vulnerability stems from the way Halyx uses them, it is covered.
• The Art-Net, sACN and DMX lighting protocols. They have no authentication by design: any device on the lighting network can send or read this data. A report is accepted only if Halyx makes this risk worse.
• Denial-of-service attacks and load testing.
• Social engineering (phishing, phone calls, impersonation) targeting us, our customers or our service providers.
• Attacks that require physical access to the machine, or administrator rights already obtained on it.
• Reports from automated tools without demonstration of a real impact (for example a missing HTTP header with no exploitable consequence).
• Versions of Halyx that are no longer supported (see section 9), and versions modified by a third party.

3. Reporting a vulnerability

3.1. How to reach us

3.1.1. Write to contact@halyxapp.com, with “Security” in the subject line.

3.1.2. You may write in French or in English.

3.1.3. For highly sensitive information, first ask us for an encrypted means of exchange, without including technical details in your first message.

3.1.4. Do not report an unfixed vulnerability in a public post, on social networks or on a forum.

3.2. What to send us

• The Halyx version (failing that, the download date) and the system (for example Windows 11).
• A description of the vulnerability and its possible impact.
• The steps to reproduce it and, if possible, a minimal proof of concept.
• The date of discovery.
• Your name or pseudonym, if you wish to be credited (section 13).

3.3. Another possible channel: ANSSI

In France, you may also report a vulnerability to the French National Cybersecurity Agency (Agence nationale de la sécurité des systèmes d'information, ANSSI), which protects the identity of the person reporting. This mechanism is provided for by article L. 2321-4 of the French Defence Code. Information: cyber.gouv.fr.

4. Rules for good-faith research

For your research to be considered in good faith, we ask you to:

• test only on your own installation and with your own account;
• not access, modify or delete another user's data;
• stop as soon as you encounter a third party's personal data, not keep it, and tell us in your report;
• not disrupt a show, an installation in operation or another user's service;
• not test third-party services beyond what is necessary to demonstrate the Halyx vulnerability;
• not circumvent the licence to obtain free use or to distribute it;
• use a vulnerability only to the extent necessary to demonstrate it;
• keep the vulnerability confidential until it is fixed, under the conditions of section 8;
• not demand anything in exchange for your report.

5. No legal action for good-faith research

5.1. If you comply with sections 2 to 4, we will not take any legal action or file any complaint against you in respect of your research.

5.2. Within this framework, we consider your research to be authorised under the Halyx end-user licence, in particular with regard to the prohibition on reverse engineering, on circumventing the licence and on unauthorised access to online services. The end-user licence (article 9) expressly provides for this.

5.3. This commitment binds only us. It does not bind the public prosecutor, the authorities, third-party services (section 2.2) or other users. It does not authorise you to break the law.

5.4. If another person takes action against you for research that complies with this policy, we will, if you ask us, state that your research complied with this policy.

5.5. If you are unsure about a testing method, write to us before using it.

6. Our response times

Halyx is published by a single person. The times below are targets that we undertake to aim for, in French working days.

If we cannot meet a deadline, we will tell you and explain why.

7. Assessment and fixing

7.1. We assess the severity of each confirmed vulnerability according to its real impact on users and on shows, based on a recognised scale (CVSS).

7.2. We fix without undue delay. Our fix targets are as follows:

7.3. An actively exploited vulnerability is treated with absolute priority, whatever its estimated severity.

7.4. Where technically possible, we release security fixes separately from new features.

7.5. We keep you informed of the fix and invite you to check it before its release if you wish.

8. Coordinated disclosure and security advisories

8.1. We ask you not to make the vulnerability public before the fix is released, or before 90 days from your report if no fix is released. This period may be adjusted by mutual agreement, for example if the vulnerability is already being exploited or if the fix is particularly complex.

8.2. When a fix is available, we issue a security advisory. It accompanies the update that fixes the vulnerability and is brought to users' attention as set out in section 9.4. It states:

• the description of the vulnerability;
• the affected versions;
• the impact and severity;
• the fixed version and what the user must do.

8.3. In justified cases, where publishing the details would create more risk than protection, we may withhold the technical details until users have been able to install the fix.

8.4. Where relevant, we request a CVE identifier for the vulnerability.

9. Security updates and support period

9.1. Support period. We supply security updates for Halyx throughout its support period. This period covers at least the term of your subscription and, in any event, the minimum period required by law, in particular by the French Consumer Code and by Regulation (EU) 2024/2847 on cyber resilience under the conditions in which it applies. If we set an end-of-support date, we state it in the software and at the time of purchase, and it cannot be earlier than those periods.

9.2. Free of charge. Security updates are free and supplied to all users, with or without an active subscription, throughout the support period.

9.3. Availability. Each security update remains available for at least 10 years after its release, or until the end of the support period if that is longer. It is supplied to you on simple request to contact@halyxapp.com.

9.4. Information. We inform you of each available security update, in the software or by email to your account address. The message explains what it fixes, what you must do and the consequences if you do not install it.

9.5. Installation. You choose when to install: you can postpone installation, for example during a show. If you do not install, within a reasonable time, an update of which you have been informed, together with its consequences, we are not liable for a defect resulting solely from that failure to install, unless it is due to incorrect installation instructions (article L. 224-25-25 of the French Consumer Code).

10. Third-party components

10.1. Halyx uses open-source libraries. We monitor published vulnerabilities affecting them.

10.2. If we discover a vulnerability in a third-party component, we report it to the person or organisation that maintains it. If we write a fix, we pass it on to them.

10.3. For each released version, we draw up the list of the software components it includes, covering at least its direct dependencies. It can be viewed in the software (Settings › Legal documents › Third-party licences). We provide it to market surveillance authorities on request, in a common, machine-readable format.

11. Reporting to the authorities

11.1. Regulation (EU) 2024/2847 on cyber resilience

11.1.1. Since 11 September 2026, we report any actively exploited vulnerability in Halyx and any severe incident having an impact on its security. The report is sent simultaneously to the computer security incident response team (CSIRT) designated as coordinator in France, where the publisher is established, and to the European Union Agency for Cybersecurity (ENISA), through the single reporting platform.

11.1.2. Deadlines run from the moment we become aware:

11.1.3. We inform the affected users, and if necessary all users, without undue delay, of the vulnerability or the incident and of the measures they can take.

11.2. Personal data (GDPR)

11.2.1. If a vulnerability leads to a personal data breach presenting a risk to individuals, we notify the CNIL (the French data protection authority) without undue delay and, where feasible, no later than 72 hours after becoming aware of it (article 33 GDPR).

11.2.2. If the risk is high, we also inform the individuals concerned without undue delay (article 34 GDPR).

11.2.3. The processing of personal data is described in the Halyx privacy policy, available in the software (Settings › Legal documents).

11.3. Other obligations

We comply with the other applicable reporting obligations. In particular, where article L. 2321-4-1 of the French Defence Code applies, we notify ANSSI of any significant vulnerability or any incident compromising the security of Halyx, and we inform the users concerned under the conditions and within the time limits set by ANSSI.

12. Security measures in place

This section describes actual Halyx measures. It is not a guarantee that there are no vulnerabilities.

• Show data: the content of shows stays on the user's machine. It is not sent to our services.
• Payment: payments are processed by Stripe. We neither see nor store card numbers.
• Account: passwords are managed by our authentication provider (Supabase); we do not know them. Confirmation codes sent by email are valid for one hour. Sign-in attempts and requests for codes by email are rate-limited.
• Account sign-in: sign-in information is stored encrypted on the computer where Halyx is installed (on Windows, tied to the Windows session that runs Halyx). It is never sent to the other devices connected to Halyx. Changing the account's email address requires its password; from a device other than the computer where Halyx is installed, managing the subscription, downloading your data or releasing a machine require it too.
• Licence: the licence is verified on the machine by an electronic signature. The machine identifier is never sent in plain text.
• Local network: Halyx can serve its interface over HTTPS. Your Halyx account password, the codes received by email and gift codes are accepted without HTTPS only on the computer where Halyx is installed; from another device, HTTPS is required. Device access codes may travel without HTTPS: use HTTPS on a shared network.
• Error reports: on by default to help us fix Halyx. On first launch, Halyx tells you about them and offers to turn them off; you can also do so at any time in Settings. A report contains, in particular, the technical description of the error, the Halyx version and the system. The software removes your email address, tokens and IP addresses from it; it attaches neither your password nor the content of your shows. Reports are kept for 90 days at most. The details, and their limits, are set out in the privacy policy.

Our recommendations to users:

• install security updates as soon as possible;
• never make Halyx directly reachable from the Internet;
• use a lighting network separate from the public network or the audience network;
• use HTTPS access when devices connect to Halyx;
• choose a unique and strong account password.

13. Acknowledgements

13.1. We do not offer a financial reward (no “bug bounty” programme).

13.2. With your consent, we credit you publicly in the security advisory, under the name or pseudonym of your choice.

14. Changes to this policy

14.1. We may change this policy, in particular to keep up with changes in the law. A change never reduces the support period or the update commitments announced at the time of your purchase.

14.2. The version in force is the one displayed in the software (Settings › Legal documents), with its number and date. It is also sent to you on simple request to contact@halyxapp.com.

14.3. A report is handled according to the version in force on the day it was sent.

15. History