Security Review
The standard a writeup meets to be published.
Security Review is a curated technical publication. Being published here means a piece met a standard, not that it was uploaded. This is that standard, stated in terms of the work rather than of who reviews it.
Scope
What we publish
- Vulnerability research and responsibly disclosed bug bounty writeups.
- CTF writeups.
- Exploit development and technique deep dives.
- Security investigations and forensic analysis.
- Engineering deep dives with security relevance.
The bar
Every accepted piece meets all four
- Original
- It is your work, or it clearly credits the prior work it builds on.
- Evidenced
- Claims come with proof: requests, responses, code, logs, artifacts. Impact is scoped honestly.
- Reproducible
- A competent reader can follow the method and, where feasible, reproduce the result.
- Lawful
- The work was authorized, or the issue was responsibly disclosed. This is a precondition, not a formality.
Review
How a submission becomes a publication
- 01Submission, by email.
- 02Editorial screen: scope, authorization and disclosure status.
- 03Technical review: the evidence is checked and, where feasible, reproduced.
- 04Decision: accept, revise or decline. We decline more than we accept.
- 05Copyedit: light. We fix clarity and errors and keep your voice.
- 06Publish, under your byline.
The mark
Verified by Threatless Security Review
A piece carries the verified mark only when its evidence was reproduced during review. The mark is institutional: it speaks for the publication and its process, and it names no individual reviewer. Authors are credited individually, with the links they provide, and keep ownership of their work.
Security Review
Ready to submit?
Send a draft with its evidence and disclosure status. We review every submission against this standard.