Report review
What happens to a report?
We read the submission, check that the affected asset is in scope, try to reproduce the issue under your program rules, and look for earlier reports of the same problem. If the finding holds up, we explain the impact and give your engineers the steps and evidence they need.
If you are starting from scratch, we help write the policy, choose a reporting channel, and decide how urgent reports reach the right people. Your organization makes the final calls on acceptance, rewards, fixes, and disclosure.
WHAT YOU GETA reporting policy your team can use and technical review of the reports that come in.
What we can handle
Help with setup, report review, or both.
We can start before the first report arrives or join a program that is already running.
Set the rules
List the assets researchers may test, what is off limits, how to report a finding, and what happens after they do.
Prepare the team
Choose a reporting channel and name the people who will receive, escalate, and decide on submissions.
Check the reports
Reproduce claims where it is safe to do so, check scope and duplicates, and separate security issues from incomplete reports.
Explain the risk
Show what an attacker could do, note uncertainty, and recommend a severity for your program owner to review.
Give engineers what they need
Write up reproduction steps and impact, identify an owner, and answer questions during the fix.
Watch the queue
Review older reports, recurring issues, and any point where the policy or intake process is causing confusion.
How an engagement starts
We agree on the rules before touching the queue.
Response times and responsibilities depend on your report volume, risk, and internal team.
Meet the program owner
Confirm scope, access, reporting channel, escalation contacts, data handling, and who makes final decisions.
Review the starting point
For a new program, prepare the policy and intake process. For an existing one, review the queue and current workflow.
Work through reports
Check scope and evidence, reproduce issues when authorized, and hand confirmed findings to the right team.
Check what changed
Review decisions and recurring problems with you, then adjust the workflow where it is slowing people down.
Can you help launch a vulnerability disclosure program without rewards?
Yes. We can help define a disclosure policy and reporting workflow without a paid bounty. Reward structure and any program expansion are choices for your organization.
Can you triage reports in a program we already run?
Yes. We first review your policy and queue, then agree on access, decision authority, and when an issue needs immediate escalation.
Who decides whether a report is accepted and rewarded?
We check the technical claim and recommend a severity. Your program owner decides whether to accept the report, pay a reward, make a fix, or publish a disclosure.
Can researchers submit vulnerabilities through this website?
No. This contact form is for organizations asking about services. Researchers should use the reporting channel named in the affected organization's published disclosure policy. Please do not put exploit details in a sales inquiry.
Need help setting up or working through reports?
Tell us whether you are starting a program or need help with an existing one. Your reporting channel and approximate report volume are enough to start; please leave vulnerability details out of the sales form.