Vulnerability Disclosure Policy

We conduct good-faith security research and coordinated vulnerability disclosure.

We do not extort, sell access, retain sensitive data beyond what is necessary to demonstrate impact, deploy persistence, or disclose unresolved vulnerabilities before a reasonable remediation window has passed.

Published disclosures

ZisK: a missing sign constraint in signed remainder
0xPolygonHermez/zisk  ·  fixed upstream

All disclosures →

Reporting

Report a vulnerability to security@cerinamroth.com. Contact details, our encryption key, and this policy are published in security.txt. Encrypt sensitive reports to our PGP key.