home / scope & boundaries

Scope & Boundaries

Private reports are welcome. Here is what I accept, how fast I respond, and where my limits are.

What I accept

I accept private reports. Send them through the contact form, encrypted with my PGP key and pasted into the PGP field if they contain anything sensitive. Reports are treated as confidential, are never discussed publicly without your agreement, and you are credited if you want to be.

In scope

  • Security issues in this website and the code and tools I publish.
  • Vulnerabilities in the areas I research (operating systems, kernels, isolation, boot and trusted computing, web and AI security) where you want a second opinion or help coordinating disclosure.
  • Errors in published write-ups, including anything that identifies a person or organisation (see the sanitization policy).

Out of scope

  • Denial-of-service, volumetric or brute-force testing.
  • Social engineering, phishing or physical attacks against me or anyone else.
  • Automated scanner output with no demonstrated impact.
  • Third-party services I link to or use; please report those to their owners.
  • Anything that needs access to other people's data to demonstrate.

Response times

acknowledgement
within 3 business days
triage
initial assessment within 7 days
updates
at least every 14 days until resolved
disclosure
90 days from report by default, sooner for active exploitation by agreement

What I do

  • Acknowledge, triage and reproduce the report, and tell you what I find.
  • Keep you updated and agree a disclosure timeline with you and the affected party.
  • Coordinate with vendors and owners on your behalf where that is useful.
  • Publish only after the issue is fixed, following the sanitization policy.
  • Not take legal action against good-faith research on this website that stays within this scope.

What I do not do

  • Run a bug bounty or pay for reports. Credit is what I can offer.
  • Test or touch systems without the owner's written authorisation.
  • Keep, copy or share data I come across while proving an issue.
  • Publish active vulnerabilities, exploit payloads or identifying details.
  • Develop or supply exploits for third parties, or provide legal advice.

Changes

This page may change as my work does. The version in effect when you send a report is the one that applies.