TecSecurity Vulnerability Research

Research governance

Coordinated Disclosure Policy

TecSecurity Research Pty Ltd conducts vulnerability research on software we license and operate ourselves. Findings go to the affected vendor before they go anywhere else. This page states how that works, in full.

Research scope

We research software that we have lawfully obtained and that we run on hardware and in virtual environments we own and operate. Our lab is the target.

We do not test live systems belonging to third parties. Where a client commissions research against their own product, the work proceeds only under a written engagement that names the target, defines the scope, and records the client’s authorisation to test it.

We do not conduct unauthorised access, credential theft, data exfiltration, social engineering against real users, denial-of-service testing, or any activity against production systems that we neither own nor have been authorised in writing to assess.

Vendor-first reporting

Every vulnerability we discover is reported to the affected vendor, in the large majority of cases through the Zero Day Initiative, which manages vendor communication and disclosure timelines on our behalf. Where a vendor operates its own programme and direct reporting is more effective, we report directly.

We publish nothing before the vendor has been notified and the applicable disclosure timeline has run.

Embargo and publication

  • We respect the disclosure timeline set by the coordinating programme or agreed with the vendor.
  • We support reasonable extensions where a vendor is actively remediating and asks for more time.
  • Advisories are published after a patch is available, or after the coordinating programme’s timeline expires, consistent with that programme’s policy.
  • Where publication would create risk disproportionate to its defensive value, we withhold detail.

Handling of exploit code

Proof-of-concept code exists to establish that a flaw is real and to communicate its true severity to the vendor. It is written for that purpose and no other.

  • Working exploit code is provided to the affected vendor, or to the coordinating programme, and to the client who commissioned research on their own product.
  • It is not published while a vulnerability is unpatched.
  • Publicly released material is limited to what demonstrates the issue. Published advisories and write-ups are redacted where full detail would provide meaningful assistance to an attacker without adding defensive value.
  • We do not sell, broker, or supply exploit capability to third parties for use against systems those parties do not own or are not authorised to test.

Client engagements

Research performed for a client is governed by a written engagement that records the authorised scope. Findings are delivered to that client and, where the flaw affects software they do not own, coordinated with the upstream vendor under this policy.

Client work does not extend our access, tooling, or third-party service entitlements to the client. Deliverables are findings and analysis.

Reporting a vulnerability to us

To report a security issue in our own infrastructure or published material, email rocco@tecsecurity.io, encrypted where possible.

We aim to acknowledge reports within five business days. We will not pursue legal action against researchers who report in good faith, act within the scope of this policy, and give us reasonable time to respond before publishing.

Contact

TecSecurity Research Pty Ltd · ACN 685 055 421 Melbourne, Victoria, Australia rocco@tecsecurity.io