{"id":5682,"date":"2026-09-09T23:14:26","date_gmt":"2026-09-09T21:14:26","guid":{"rendered":"https:\/\/dgtlms.fr\/?page_id=5682"},"modified":"2026-09-10T08:19:41","modified_gmt":"2026-09-10T06:19:41","slug":"securite-conformite","status":"publish","type":"page","link":"https:\/\/dgtlms.fr\/en\/lms-dispatcher\/securite-conformite\/","title":{"rendered":"Security & compliance"},"content":{"rendered":"
\n
\n \"\" <\/div>\n<\/div><\/div><\/div><\/div>
\n\t
\n\t\t\t\t\t\t\t

\n\t\t\t\tTechnical security file\t\t\t<\/h1>\n\t\t\t\t\t<\/div>\n<\/div>
<\/span><\/div>\n\t
\n\t\t
\n\t\t\t

The security of an LMS is not demonstrated by a page of promises. We maintain a technical security file, updated after each audit, which we share in full with your IT department, your CISO or your data protection officer. This page summarises its substance.<\/span><\/p>\n

The reference document covers the authentication architecture, the authorisation model, session management, OWASP coverage, defence in depth, secrets management, logging, third-party dependencies, the responsible disclosure procedure and GDPR compliance. It is dated, versioned, and follows the version of the product you are running.<\/span><\/p>\n

Le dernier audit de s\u00e9curit\u00e9 global a \u00e9t\u00e9 men\u00e9 en avril 2026<\/strong>The most recent full security audit was carried out in April 2026. Its findings and the associated fixes are public: they are listed in our [changelog] under the \"Security\" label. changelog<\/a> sous le label \u00ab S\u00e9curit\u00e9 \u00bb.<\/span><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div>

\n\t
\n\t\t\t\t\t\t\t

\n\t\t\t\tOWASP Top 10 coverage (2021)<\/span>\t\t\t<\/h2>\n\t\t\t\t\t\t\t

\n\t\t\t\tEach of the ten categories in the OWASP framework is addressed by identified, documented measures.\t\t\t<\/p>\n\t\t\t<\/div>\n<\/div>\n\t

\n\t\t
\n\t\t\t\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CATEGORY<\/th>\nMEASURES<\/th>\n<\/tr>\n<\/thead>\n
A01 \u2014 Broken access control<\/strong><\/td>\nPermission model enforced on every entry point, anti-CSRF token on sensitive actions, strict validation against account takeover.<\/td>\n<\/tr>\n
A02 \u2014 Cryptographic failures<\/strong><\/td>\nPasswords hashed with bcrypt, HMAC-SHA256 signing of cookies and webhooks, constant-time secret comparison, unique keys per installation.<\/td>\n<\/tr>\n
A03 \u2014 Injection<\/strong><\/td>\nSQL queries systematically protected (typing, escaping, column and sort whitelists), prepared statements, systematic HTML escaping of anything that reflects user input.<\/td>\n<\/tr>\n
A04 \u2014 Insecure design<\/strong><\/td>\nSafeguard against open redirects, password reset redesigned around a token, Zip Slip protection on archive import, path-traversal checks on file reads.<\/td>\n<\/tr>\n
A05 \u2014 Security misconfiguration<\/strong><\/td>\nSecrets kept out of the repository with a documented example file, HttpOnly<\/code> \/ Secure<\/code> \/ SameSite<\/code>, cookies, directory listing disabled, protection of sensitive folders handled by the product.<\/td>\n<\/tr>\n
A06 \u2014 Vulnerable and outdated components<\/strong><\/td>\nRegular audits of PHP and JavaScript dependencies, deliberately lean dependency footprint, quarterly update policy.<\/td>\n<\/tr>\n
A07 \u2014 Identification and authentication failures<\/strong><\/td>\nRate limiting with increasing delay, session regeneration after login, signed \"remember me\" cookie, single-use reset token, anti-enumeration responses for accounts.<\/td>\n<\/tr>\n
A08 \u2014 Software and data integrity failures<\/strong><\/td>\nConstrained deserialisation (no unauthorised object instantiation), signing of inbound and outbound webhooks, state verification on OAuth2 exchanges.<\/td>\n<\/tr>\n
A09 \u2014 Security logging and monitoring failures<\/strong><\/td>\nStructured, typed application logs (authentication, failures, web services, e-mails), timestamp, IP address and user agent, optional Sentry integration.<\/td>\n<\/tr>\n
A10 \u2014 Server-side request forgery (SSRF)<\/strong><\/td>\nEvery outbound call goes through a hardened client: HTTP\/HTTPS schemes only, host whitelist, rejection of private and reserved addresses, no redirect following, TLS verification and conservative timeouts.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\n\t\t<\/div>\n\t<\/div>\n
<\/span><\/div><\/div><\/div><\/div><\/div><\/div><\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"Dossier technique de s\u00e9curit\u00e9 La s\u00e9curit\u00e9 d'un LMS ne se d\u00e9montre pas par une page de promesses. Nous maintenons un dossier technique de s\u00e9curit\u00e9, mis \u00e0 jour \u00e0 chaque audit, que nous communiquons int\u00e9gralement \u00e0 votre DSI, \u00e0 votre RSSI [...]","protected":false},"author":1,"featured_media":0,"parent":5611,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"full-width.php","meta":{"footnotes":""},"class_list":["post-5682","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/dgtlms.fr\/en\/wp-json\/wp\/v2\/pages\/5682","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dgtlms.fr\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/dgtlms.fr\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/dgtlms.fr\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dgtlms.fr\/en\/wp-json\/wp\/v2\/comments?post=5682"}],"version-history":[{"count":11,"href":"https:\/\/dgtlms.fr\/en\/wp-json\/wp\/v2\/pages\/5682\/revisions"}],"predecessor-version":[{"id":5703,"href":"https:\/\/dgtlms.fr\/en\/wp-json\/wp\/v2\/pages\/5682\/revisions\/5703"}],"up":[{"embeddable":true,"href":"https:\/\/dgtlms.fr\/en\/wp-json\/wp\/v2\/pages\/5611"}],"wp:attachment":[{"href":"https:\/\/dgtlms.fr\/en\/wp-json\/wp\/v2\/media?parent=5682"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}