Responsible Disclosure Policy

The SEC Consult Vulnerability Lab is the integrated research organization of SEC Consult, an Eviden business, one of the leading international security consultancies, with a special focus and recognized experience in application security.

During vulnerability research and security testing, e.g., penetration tests, SEC Consult regularly discovers security vulnerabilities in commercial and open-source software products. While important vulnerability information should be provided to the vendor, to the product’s customers and the security community for a variety of reasons, it is equally important to minimize the risk vulnerability disclosure poses to the affected vendors and customers.

Our Responsible Disclosure Policy document aims to provide vendors with the necessary information and timeframe needed to validate and fix a security flaw in order to mutually coordinate the public release of a security advisory as part of our responsible disclosure process. This document also clarifies the extent and limitation of effort the SEC Consult Vulnerability Lab will invest.