Vulnerability Disclosure Policy

This policy applies to vulnerabilities Hacktron identifies through its independent security research. These vulnerabilities are subject to a 30-day disclosure deadline.

When the deadline starts

The 30-day deadline begins when Hacktron notifies the affected party and provides sufficient information to identify the vulnerability.

Disclosure deadline

If a fix is made available to users before the end of the 30-day deadline, the bug report will become public on the day the fix is made available, unless Hacktron and the affected party agree to an earlier or later disclosure date.

If a fix is not made available before the deadline, the bug report will become public when the 30-day deadline expires.

Grace period

If the affected party expects to make a fix available shortly after the deadline, Hacktron may grant a brief grace period upon request. Any grace period is at Hacktron’s discretion and must be agreed before the original deadline expires.

Active exploitation

If Hacktron finds evidence that a vulnerability is being actively exploited, Hacktron may use a shorter disclosure deadline to protect users.

Third-party disclosure

If another researcher discloses the proof of concept before any applicable deadline, Hacktron reserves the right to publish its findings before the scheduled disclosure date.

Private disclosure

Hacktron may privately disclose details of the vulnerability to affected parties, including, but not limited to, Hacktron AI customers.