Security Review
Lawful work, responsibly disclosed.
Security Review publishes offensive work. That stays respectable only when the work was lawful and the disclosure was responsible. These rules are a precondition for acceptance.
Preconditions
What must be true before we publish
- Authorization or responsible disclosure
- The work was done against a target you were authorized to test (a bug bounty program in scope, a CTF, a lab, a system you own), or the issue was responsibly disclosed and is fixed or the vendor was coordinated with. Clearly illustrative examples are fine and must say so.
- No live, un-notified issues
- We do not publish exploitable details of an unfixed vulnerability in a real product whose vendor has not been notified and given reasonable time.
- No unauthorized access
- We do not publish work that depended on reaching systems or data without permission.
- Proportionate detail
- Enough to teach and to reproduce in a lawful setting, not a turnkey weapon against live third parties. Redact credentials, personal data and customer specifics.
Disclosure status
Every writeup declares one
- Not applicable
- CTF, lab, owned system, or illustrative work.
- Coordinated, vendor notified
- Reported to the vendor; may not be fully fixed yet.
- Coordinated, fixed
- Reported and resolved.
Report a concern
If something looks wrong
If something published here looks unsafe or improperly disclosed, email hello@threatless.io. We will review it and, if needed, take it down.
Security Review
Good work, done right.
If your work was authorized and responsibly disclosed, we want to read it.