Inside Our Responsible Disclosure Process

Finding a vulnerability in an embedded system is only the first step. What happens next determines whether that finding makes devices safer or simply becomes a liability for everyone involved. Our disclosure process is built around one principle: give the vendor a real opportunity to fix the issue before any details become public.

Once a finding is confirmed and reproducible, we prepare a private technical report with enough detail for the vendor's engineering team to validate and remediate the issue without ambiguity. We agree on a disclosure timeline up front, typically 90 days, with flexibility for issues that require hardware revisions or multi-party coordination.

Throughout the process we stay available to support remediation testing, confirm that a patch actually closes the gap, and help the vendor understand the root cause rather than just the symptom. Good disclosure work is collaborative, not adversarial.

Public advisories, when we publish them, describe the class of issue and its impact without providing a ready-made exploitation guide, and only go out once a fix or mitigation is available to affected users.