Disclosure
The vendor hears first
We publish after ninety days, fixed or not. The same terms apply to every vendor.
The clock
What happens, and when
The clock starts when we report the flaw.
-
We report it
Privately, with a working reproduction.
We send the analysis, affected versions, and proof of concept to the vendor's security contact. We do not announce it first.
-
You acknowledge
We ask for an acknowledgement within seven days.
If there is no reply, we try another contact, then a CERT or coordinator. The publication clock keeps running.
-
You fix it
The window is ninety days, from the day we reported it.
The clock starts at our report. We can extend by fourteen days for a fix in progress, and further for an agreed release date. Extensions are not indefinite.
-
We publish
On the date, whether or not it is fixed.
The advisory includes analysis, contact dates, responses, and fix status. If unfixed, it gives users defensive steps.
One exception
When it is already being exploited
For active exploitation, we shorten the window to seven days and publish defensive guidance, fixed or not.
Commitments
What we will and will not do with a flaw
Our rules for handling findings.
-
The vendor hears first
The vendor hears before clients or the public, including when a client commissioned the research.
-
We do not sell to brokers
We do not sell undisclosed flaws to brokers or offensive-capability buyers.
-
Proof of concept, not weapons
We publish enough to prove the flaw, limiting detail when it would enable misuse.
-
Authorised research only
We work only on lawful targets or those authorised in writing by their owner.
-
Other people's data stays other people's
If we encounter real user data, we stop, report it, and retain none of it.
-
Credit where it is due
We credit vendors and engineers who fix findings, if they want credit.
There is no version of this where something we found stays unfixed because somebody paid for it to.
In reverse
Reporting something to us
Found a flaw in this site, a Skull Solutions system, or our tools? Email us. We acknowledge within seven days, make no legal threats, and credit you if you wish.
Found something in ours?
Acknowledgement within seven days, and you get credited unless you would rather not.