Coordinated Disclosure Policy

We report vulnerabilities found during our own independent research into software, devices, and services. With the client's permission, we also report vulnerabilities in third-party products that we find during a client engagement.

Findings specific to a client's own environment belong to that client. They are never published and never reported to anyone else without the client's written consent.

We contact the vendor privately through its published security contact or disclosure program. The first report includes a description of the issue, the affected versions we tested, reproduction steps, and our assessment of impact.

We confirm the vendor has received the report, answer technical questions, and test fixes when the vendor asks us to. Where appropriate, we request a CVE identifier and agree on the publication date with the vendor.

Vendors have 90 days from our first report to release a fix. If the vendor is actively remediating and needs more time, we extend the window by agreement.

If a vendor does not respond, we make repeated attempts to reach it, including through a coordinator, before the window closes.

Once a fix is public and the disclosure window has closed, we publish an advisory on our advisories page. Where it helps defenders, we follow with a technical write-up in our research.

If you find a security issue in an Atarus website or service, email [email protected] with a description of the issue and the steps to reproduce it.

Please test only against assets you are authorized to test, do not access or keep data that is not yours, do not degrade the service for others, and give us reasonable time to fix the issue before you disclose it. We will acknowledge your report and keep you informed as we work on it.