Our approach
Somebody has to look
We look for flaws before they become somebody else's advisory.
Why
Advisories are written by somebody. It may as well be us.
Advisories begin with someone finding a flaw. We do that work directly, so vendors can fix it.
How we work
Six things we hold to
-
Authorised work only
Software we may lawfully research, or a target authorised in writing by somebody who owns it.
-
Proof before severity
We prove impact before rating it.
-
Honest about nothing
Empty research windows are reported as such.
-
The vendor hears first
Always, and before a paying client where the flaw is in software they only use.
-
Terms in advance
Our published disclosure clock applies to everyone.
-
Direct contact
You speak with the researcher directly.
Got something worth breaking?
Tell us about the target and what you need to know.