{
  "schema_version": "1.0",
  "url": "https://cerinamroth.com/policy/",
  "title": "Vulnerability Disclosure Policy — Cerin Amroth",
  "description": "How Cerin Amroth conducts good-faith security research and coordinates vulnerability disclosure, including contact details and publication policy.",
  "date_modified": "2026-09-25",
  "representations": {
    "json": "https://cerinamroth.com/data/pages/policy.json",
    "markdown": "https://cerinamroth.com/data/pages/policy.md"
  },
  "headings": [
    {
      "level": 1,
      "id": null,
      "text": "Vulnerability Disclosure Policy"
    },
    {
      "level": 2,
      "id": null,
      "text": "Published disclosures"
    },
    {
      "level": 2,
      "id": null,
      "text": "Reporting"
    }
  ],
  "links": [
    {
      "text": "Cerin Amroth",
      "url": "https://cerinamroth.com/"
    },
    {
      "text": "Home",
      "url": "https://cerinamroth.com/"
    },
    {
      "text": "ML",
      "url": "https://cerinamroth.com/ml/"
    },
    {
      "text": "JWST",
      "url": "https://cerinamroth.com/jwst/"
    },
    {
      "text": "Security",
      "url": "https://cerinamroth.com/policy/"
    },
    {
      "text": "Contact",
      "url": "https://cerinamroth.com/#contact"
    },
    {
      "text": "ZisK: a missing sign constraint in signed remainder",
      "url": "https://cerinamroth.com/disclosures/zisk-signed-rem-sign-soundness/"
    },
    {
      "text": "All disclosures →",
      "url": "https://cerinamroth.com/disclosures/"
    },
    {
      "text": "security@cerinamroth.com",
      "url": "mailto:security@cerinamroth.com"
    },
    {
      "text": "security.txt",
      "url": "https://cerinamroth.com/.well-known/security.txt"
    },
    {
      "text": "our PGP key",
      "url": "https://cerinamroth.com/.well-known/cerinamroth-pubkey.asc"
    },
    {
      "text": "Home",
      "url": "https://cerinamroth.com/"
    },
    {
      "text": "Disclosures",
      "url": "https://cerinamroth.com/disclosures/"
    }
  ],
  "structured_data": [
    {
      "@context": "https://schema.org",
      "@type": "WebPage",
      "name": "Vulnerability Disclosure Policy",
      "description": "How Cerin Amroth conducts good-faith security research and coordinates vulnerability disclosure, including contact details and publication policy.",
      "url": "https://cerinamroth.com/policy/",
      "inLanguage": "en"
    },
    {
      "@context": "https://schema.org",
      "@type": "BreadcrumbList",
      "itemListElement": [
        {
          "@type": "ListItem",
          "position": 1,
          "name": "Home",
          "item": "https://cerinamroth.com/"
        },
        {
          "@type": "ListItem",
          "position": 2,
          "name": "Vulnerability disclosure policy",
          "item": "https://cerinamroth.com/policy/"
        }
      ]
    }
  ],
  "content_markdown": "[Cerin Amroth](https://cerinamroth.com/) · Disclosure Policy [Home](https://cerinamroth.com/)[ML](https://cerinamroth.com/ml/)[JWST](https://cerinamroth.com/jwst/)[Security](https://cerinamroth.com/policy/)[Contact](https://cerinamroth.com/#contact)\n\n \n\n# Vulnerability Disclosure Policy\n\n \n\nWe conduct good-faith security research and coordinated vulnerability disclosure.\n\n \n\nWe do not extort, sell access, retain sensitive data beyond what is necessary to demonstrate impact, deploy persistence, or disclose unresolved vulnerabilities before a reasonable remediation window has passed.\n\n  \n\n## Published disclosures\n\n \n\n[ZisK: a missing sign constraint in signed remainder](https://cerinamroth.com/disclosures/zisk-signed-rem-sign-soundness/)\n0xPolygonHermez/zisk · fixed upstream\n\n \n\n[All disclosures →](https://cerinamroth.com/disclosures/)\n\n  \n\n## Reporting\n\n \n\nReport a vulnerability to [security@cerinamroth.com](mailto:security@cerinamroth.com). Contact details, our encryption key, and this policy are published in [security.txt](https://cerinamroth.com/.well-known/security.txt). Encrypt sensitive reports to [our PGP key](https://cerinamroth.com/.well-known/cerinamroth-pubkey.asc).\n\n Cerin Amroth — independent security research & coordinated vulnerability disclosure. · [Home](https://cerinamroth.com/) · [Disclosures](https://cerinamroth.com/disclosures/)\n",
  "content_sha256": "6e67f8e8c704278b309d1210d508f7d00a1f5b636cc0236ed076d576b8fbb5ff"
}