Payatu Disclosure Policy

Our disclosure policy, start to finish.

When Payatu finds a vulnerability, we notify the vendor first and give them time to fix it before anything becomes public. This policy sets out each stage, the 90-day disclosure window, and how the process stays confidential until then.

Day 0 · We notify the vendor

We disclose the vulnerability to the vendor and wait for acknowledgement.

By day 7 · We try again

We disclose the vulnerability to the vendor and wait for acknowledgement.

By day 10 · The path splits

If the vendor has acknowledged us, we convey that the 90-day public-disclosure window has begun, and provide technical details if the vendor asks. If there is still no acknowledgement, we proceed toward public disclosure and inform CERT or another disclosure coordinator, chosen case by case.

Before day 90 · The vendor patches

The vendor fixes and tests the vulnerability, announces the patch, and informs Payatu.

After the patch, or day 90 · We disclose

 We make our public disclosure after 90 days from notification or after the vendor releases a patch, whichever happens first.
WHAT WE PUBLISH

Where the findings go after disclosure

Once a vulnerability is disclosed, we share our findings, with technical details, for the benefit of
the larger community through:
  • Blogs
  • Technical papers at security conferences, anywhere in the world
  • Inclusion in our training courses and study material
CONFIDENTIALITY AND SECURE COMMUNICATION

How we handle the non-disclosure period

For communication with the vendor during disclosure, the policy sets the following:
  1. Throughout the non-disclosure period, we expect regular communication with the vendor, and we keep it confidential.
  2. Only the finder of the vulnerability and the Payatu-appointed authority for the Disclosure Response Program are in the communication loop.
  3. Communication with the vendor and progress through each stage are documented and tracked on Payatu's internal systems.
  4. We prefer cryptographically secure communication channels with vendors, where they support and provide them.
As a matter of policy, we keep CERT or other industry-trusted disclosure coordinators informedof our findings. This is the finder's right and does not require the affected vendor's permission.
Dark scene with vertical thin orange lines resembling distant illuminated bars or streaks against a black background and a faint horizontal red glow near the bottom.

Let's make cyberspace secure together

 Whether you're disclosing an issue to us or want our researchers testing your product, start here.

Talk to an expert
White arrow pointing diagonally upward to the right on a black square background.White arrow pointing diagonally upward to the right on a black square background.White arrow pointing diagonally upward to the right on a black square background.
Black downward arrow on a white background.Black downward arrow on a white background.
This is the default text value
White arrow pointing downward on a dark background.White arrow pointing downward on a dark background.
This is the default text value
White arrow pointing downward on a dark background.White arrow pointing downward on a dark background.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.