The method
Everything below is done from the outside, like any visitor, using tools anyone can run. It is here so the procedure can be argued with, not just the result.
How a case is analyzed
The technical detail of the detection stage: what gets looked at, with what, and what each step produces. All from the outside, like any visitor.
Observable surface
Record what the server hands over without being asked: headers, certificate, DNS, and which resources stay reachable without authentication.
tools curl · openssl · dig
out surface inventory
Configuration read
Compare what was observed against expected practice: missing security headers, directory listings, exposed versions, outdated TLS.
tools testssl.sh · observatory
out configuration deviations
Impact assessment
Determine what each deviation enables and whether it reaches personal data. A directory listing is not the same thing when it exposes binaries as when it exposes identity documents.
tools CWE · CVSS 3.1
out class, severity, and context
Verification and discard
Confirm the finding reproduces, and drop whatever does not. Anything that cannot be demonstrated from public surface never reaches the report.
tools manual reproduction
out finding confirmed or dropped
Report and anonymization
The private report goes to the owner in full, exact paths included. The public version is written separately: same pattern, nothing that identifies who it was.
tools template + checklist
out private report + public case
Where it stops
No credentials are tested, no identifiers are manipulated to reach someone else’s data, no exploitation scanners are run, and nothing beyond the minimum needed to verify is ever downloaded. If a finding would require crossing that line, it is not investigated: we report what was observed and recommend an authorized audit.
How we handle a case
Every case we publish actually happened. None of them names who caused it. Between the report with a name on it and the public case there is a process, and this is the process.
PRIVATEname, domain, contact, exact paths · never leaves the internal record
Only what the server hands over without anyone asking permission: headers, certificate, DNS, resources reachable without authentication. No credentials are tested and nothing is forced.
- stays private
- name, domain, exact paths, screenshots
- exists publicly
- nothing yet
The vendor receives the entire finding, with paths and steps to reproduce it. It is the version that holds the most data in the whole process, and the only one carrying their name.
- stays private
- the full write-up + the contact it was sent to
- exists publicly
- nothing yet
The clock starts when the report is sent. Ask for more time with a concrete plan and you get it. Publishing early does not punish the vendor: it hands the map to anyone while people are still exposed.
- stays private
- the case log: what was sent, when, what came back
- exists publicly
- nothing yet
The sector is generalized, figures become ranges, dates become a half-year and relative days. A person reviews the result and signs it with a name and a date. The friction is deliberate: a badly anonymized case is not given away by what you removed, but by the combination of what you left in.
- stays private
- everything above, in a record that shares no database with the public one
- exists publicly
- class, mechanism, impact, prevention and how long it took
Remediated and verified
No response after 90 days
Both outcomes go through the same gate: silence does not license publishing without anonymization.
Live vulnerability · unauthorized testing · sensitive data → never published
ANONYMIZATIONsector generalized · figures bucketed · half-year and relative days · no pathsreviewed by a person, signed with a name and a date
PUBLIC
Published: vulnerability class, mechanism, impact, how to prevent it, how long it took to close.
Not published: name, domain, paths, versions, payloads, screenshots, exact dates.
Based on real events.
The two lanes share no database. The private record holds the name, domain, contact, and exact paths; the public one has none of those fields. Between them there is no script — there is a person who reviews the anonymization and signs it with a name and a date. That friction is deliberate: a badly anonymized case is not given away by what you removed, but by the combination of what you left in.