How we run a disclosure

Sometimes we find a flaw in software that is not our client’s: a library, a vendor, an open source tool. What we do next matters as much as the finding.

Our rules

1. We tell the maintainer first, privately.
2. We give them a fair window to fix it, usually ninety days.
3. We help them test the fix if they want us to.
4. We publish only after users can protect themselves.

Most maintainers are grateful. A few are not. We follow the same rules either way, because the people we protect are the users.