Secureverything · independent · responsible research
Found in public.
Reported in private.
We are cybersecurity enthusiasts. We search the public internet for vulnerabilities and report them directly to the companies that own those systems.
- Search
- public internet
- Confirm
- only far enough
- Report
- straight to the company
- Offensive action
- none
01 — Approach
Look. Confirm. Hand it over.
-
01
Search
We look at systems already exposed on the public internet: sites, services, and configurations a visitor can reach without being invited in.
-
02
Confirm
We check only far enough to know a finding is real. We do not go further, and we do not use the issue against the service.
-
03
Report
We write to the company that owns the system, through the security contact they publish, and describe what we saw so they can fix it.
02 — Reporting
The company hears it first.
There is no offensive action against services.
Secureverything does not attack, disrupt, deface, or misuse the systems we look at. We do not take data, we do not hold access, and we do not publish a finding before the owner has had a chance to respond. A report is a notice to the organization that can fix the problem — nothing else.
03 — Principles
What we will not do.
-
No offensive operations
We do not run attacks against services, and we do not turn a weakness into harm.
-
No quiet collection
A finding is for the owner. We do not keep access, copy private data, or use what we see for any other purpose.
-
No public drop
We report directly to the company and give them time to respond before anything is said in public.
-
No invented scope
We stay on the public internet. If a system is not ours and not openly reachable, we leave it alone.
04 — Contact
Reports go to the owner.
If we contact you, it is because a system under your company’s name appears to have a vulnerability. Reply on that thread. This page is not a place to submit someone else’s system, and it is not an offer of offensive work.