Security Vulnerability Disclosure Policy

As an independent security researcher, I am committed to responsible and coordinated disclosure of security vulnerabilities identified during security research, testing, and investigations. Vulnerabilities may be publicly documented through this website or other appropriate platforms to help affected organizations protect their users and improve the security of their products and services.

Initial disclosure to the affected organization

The affected organization/Vendor will generally be provided with 90 calendar days from the date of the initial vulnerability report to investigate and address the issue. After this period, I may publicly disclose information about the vulnerability only if the Vendor does not respond to my report or says its not a security issue. Public disclosures will aim to balance transparency and public safety while avoiding unnecessary information that could facilitate exploitation.

Timeline may change

The disclosure timeline may be shortened or extended depending on the circumstances, including: The vulnerability is being actively exploited, The affected organization has already publicly disclosed the issue, A security update or mitigation has been released, The organization confirms that no remediation will be provided, The vulnerability presents a significant risk to users, Additional time is reasonably required to develop or deploy a fix, The affected organization requests an extension and provides a reasonable remediation plan, and if a vulnerability remains unresolved after the initial disclosure period (90 days), a public report may limit technical details where releasing them could place users at unnecessary risk.