# Vulnerability Disclosure Policy — Cerin Amroth

Source: https://cerinamroth.com/policy/

[Cerin Amroth](https://cerinamroth.com/) · Disclosure Policy [Home](https://cerinamroth.com/)[ML](https://cerinamroth.com/ml/)[JWST](https://cerinamroth.com/jwst/)[Security](https://cerinamroth.com/policy/)[Contact](https://cerinamroth.com/#contact)

 

# Vulnerability Disclosure Policy

 

We conduct good-faith security research and coordinated vulnerability disclosure.

 

We do not extort, sell access, retain sensitive data beyond what is necessary to demonstrate impact, deploy persistence, or disclose unresolved vulnerabilities before a reasonable remediation window has passed.

  

## Published disclosures

 

[ZisK: a missing sign constraint in signed remainder](https://cerinamroth.com/disclosures/zisk-signed-rem-sign-soundness/)
0xPolygonHermez/zisk · fixed upstream

 

[All disclosures →](https://cerinamroth.com/disclosures/)

  

## Reporting

 

Report a vulnerability to [security@cerinamroth.com](mailto:security@cerinamroth.com). Contact details, our encryption key, and this policy are published in [security.txt](https://cerinamroth.com/.well-known/security.txt). Encrypt sensitive reports to [our PGP key](https://cerinamroth.com/.well-known/cerinamroth-pubkey.asc).

 Cerin Amroth — independent security research & coordinated vulnerability disclosure. · [Home](https://cerinamroth.com/) · [Disclosures](https://cerinamroth.com/disclosures/)