Disclosure
Vulnerability disclosure policy
We publish research on other people’s software. It would be poor form not to make it easy to report problems in ours.
Scope
In scope
rev3rse.devand its subdomains- Open-source tools published at
github.com/rev3rse - Our email and DNS configuration
Out of scope
- Third-party services we use — report those to the provider
- Findings requiring physical access to our hardware
- Social engineering of us or anyone associated with us
- Denial of service, volumetric testing, or anything that degrades availability for others
- Reports generated by an automated scanner with no demonstrated impact
- Missing headers or configuration weaknesses with no exploitation path
Client work is not in scope here. If you have found something in software we assessed for a client, report it to that vendor through their own disclosure process. We cannot accept, triage, or forward reports on their behalf.
How to report
Email security@rev3rse.dev. Useful in a report: what you found, how to reproduce it, what an attacker gains, and any conditions required. A working proof of concept is welcome and never required.
What we commit to
| Acknowledge receipt | 2 business days |
| Initial assessment | 7 business days |
| Status updates | Every 14 days until resolved |
| Fix timeline | Communicated with the assessment, and kept honest if it slips |
We will tell you plainly if we think a report is not valid, and why. If you disagree with our assessment, say so — we will look again. We would rather re-examine a finding than be wrong in public.
What we ask
- Give us reasonable time to fix before publishing. We will agree a date with you rather than impose one
- Do not access, modify, or destroy data that is not yours
- Do not degrade the service for others
- Only test against the in-scope assets above
Recognition
We do not run a paid bounty. What we offer instead:
- Public credit, with your preferred name and link, unless you would rather stay anonymous
- A written acknowledgement you can reference
- Coordinated publication — if you want to write it up, we will review the draft for accuracy
If you are a professional researcher and something you find here is genuinely serious, tell us and we will discuss compensating you properly for it. We are not going to lean on goodwill for a critical.
Safe harbour
If you make a good-faith effort to follow this policy, we will not pursue legal action against you, and we will work with you if a third party does. Good faith means: staying in scope, not accessing data that is not yours, not degrading the service, and giving us a chance to fix before publishing.
If you are unsure whether something is in scope, ask first at security@rev3rse.dev. We would rather answer a question than receive a report we have to decline.