Disclosure policy

Report a vulnerability to me

Email secure@lochlanmcelroy.com. If the report holds sensitive details, encrypt it with my PGP key.

Tell me the affected product or page, the steps to reproduce the flaw and its impact. I reply within five working days.

How I report flaws

I contact the vendor's security team or the address in its security.txt first. If the vendor has no security contact, I use CERT/CC.

Each report gives the affected versions, the steps to reproduce and the impact.

Deadline

I publish when a fix ships, or 60 days after my first report. If the vendor is actively working on a fix, I can extend this to 90 days.

CERT/CC

I go to CERT/CC when the vendor does not answer within 14 days, when more than one vendor is affected, or when there is no security contact.

The machine-readable contact is in security.txt.