Our approach

Coordinated disclosure is our standard. The goal is for vulnerabilities to be closed before they are exploited.

1. Find

   We test software, libraries and devices that we may lawfully obtain or operate — for example open source, our own test systems, and programmes that offer a safe-harbor commitment. We do not attack third-party production systems and do not access third-party data.

2. Report

   We report through the vendor's channel, preferably via their bug-bounty programme on a platform, otherwise via security.txt or the relevant CERT. We send a clear description with a proof of concept and keep to the programme's scope and rules.

3. Coordinate

   We give the vendor 90 days for a fix by default. We shorten the deadline in case of active exploitation or high damage potential. We extend it sensibly where there is demonstrable progress.

4. Disclose

   After the fix or once the deadline passes, we publish a summary where the programme rules allow. Where possible we request a CVE identifier. We show the status of each report on the findings page.

What we do not do

• No sale or disclosure of vulnerabilities to third parties. We are compensated solely through vendors’ bug-bounty programmes.
• No security assessments or penetration tests on behalf of third parties.
• No publication of exploit code for unpatched vulnerabilities.
• No data exfiltration, no service disruption, no social engineering against vendor staff.