Scope of testing
- I only test systems that are my own, hosted in an isolated lab, or explicitly authorised by the owner in writing.
- The scope and time window of every engagement are agreed before testing starts — never widened while in progress.
- I do not access, copy or retain production data beyond what is strictly needed to demonstrate an issue.
- Findings are reported privately to the vendor first, with a reasonable period for remediation before any publication.
Safe harbor statement
I conduct research in good faith, avoid privacy violations and service disruption, and I will not exploit a vulnerability beyond the minimum necessary to demonstrate it. I never test against production systems without authorisation, and I never publish a proof of concept while a fix is still pending.
If you are a vendor and believe this research affected you, or if you would like a finding removed or amended, contact me and I will act immediately.
Storing and handling data
Test data captured during research stays on an encrypted, local volume. Anything containing real user data is deleted as soon as the report is accepted, and no captured dataset is ever shared with a third party.
Working with a CNA
For any submission I can provide:
- a schema-valid CVE 5.0 JSON record built from the advisory page itself,
- the full technical write-up with step-by-step reproduction,
- a CVSS 3.1 vector and severity justification,
- affected and fixed version ranges,
- a retest statement confirming the fix once it ships.
Timeline expectations
| Stage | Typical target |
|---|---|
| Acknowledgement of the report | within 7 days |
| Triage and confirmation | within 30 days |
| Fix released | negotiated, default 90 days |
| Public disclosure | after the fix, or 90 days after reporting |
Contact
Security-related correspondence goes to the address in the footer, or through a dedicated channel if one is published. I am happy to sign a non-disclosure agreement where a vendor requires it before sharing details.