Responsible disclosure

Received a security report from Peak?

One of our researchers found a vulnerability in your product and contacted you privately. This page explains how to check the message is really from us, what we did, and how to get the full report. The report is free.

Request your report Verify a message

What happens next.

Disclosure is private from the first message to the retest. Nothing is published.

01
We found it
Our agents flagged a likely issue on a publicly reachable part of your product.
Private
02
We confirmed it
A researcher reproduced it with the smallest possible test to prove the impact, then stopped.
Minimal
03
We contacted you
A short first message to the people who can act on it, with no exploit details.
You are here
04
You get the report
Once you confirm the right recipient, we send the full report through your preferred channel.
Free
05
You fix it
We answer your engineers' questions. If you want, we retest to confirm the fix.
Optional retest

How to verify the message.

Phishing that copies security researchers is real. Check these before you reply.

We only send from

@peaksecurity.us
@peaksec.co
@peaksec.net
@peaksec.org
@peaksec.us
@peaksec.cloud
@peaksecurity.app
@peaksecurity.dev

On LinkedIn, our researchers list Peak Security as their current employer. Not sure? Email [email protected] and we will confirm.

No attachments or downloads

A first message never includes files, installers, or login links. Do not open one that claims to be from us.

No credentials requested

We will never ask for passwords, API keys, or access to your systems to deliver a report.

No payment to get the report

The full report is free. If a message makes payment a condition of disclosure, it is not from us.

No public deadlines or threats

We do not publish your issue or pressure you with a countdown. Disclosure stays private.

What we did, and what we did not.

We test the way a careful attacker would look, and stop well short of what an attacker would do.

We did

Looked at parts of your product reachable from the internet.
Confirmed the issue with the smallest test that proves impact.
Recorded the evidence your engineers need to reproduce it.
Contacted you privately and kept the details out of first contact.

We did not

Modify, delete, or disrupt your data or service.
Keep using access beyond what confirmation required.
Publish, sell, or share the issue with anyone else.
Make the report conditional on payment.

What the report contains.

Built for the engineer who has to fix it. Each finding fits on one page.

security-report · privateHigh

Affected systemThe exact app, API, and flow

ImpactWhat an attacker could read or change

EvidenceRequests, responses, screenshots

ReproductionSteps your engineers can follow

FixA specific code or configuration change

The report goes to the person you name, through the channel you prefer: email, your security inbox, or your bug bounty platform if you run one.

See a sample report for the format. It uses fictional assets.

Common questions.

Do we have to pay for the report?

No. The report is yours for free. Some companies choose to reward the work with a bounty, and some later hire us to retest the fix or test more of the product. Both are your choice and never a condition of disclosure.

We have a bug bounty or VDP. Can you use it?

Yes. Tell us the program or address and we will submit there and follow its rules.

Did you access our customers' data?

Confirmation is kept to the minimum needed to prove impact, and the report states exactly what was accessed. If any data was reached during confirmation, we can delete our copies on request.

Who should handle this on our side?

Whoever owns security or the affected product: usually the CISO, head of security, CTO, or an engineering lead. Forwarding our message to them is enough. We will continue with whoever replies.

We do not want to hear from you again.

Reply "stop" or email [email protected] and we will not contact your company again. You can also ask us to delete what we hold about your company.

Get your report.

Reply to the original message, or email us with your company name and the person who should receive it.

[email protected]How Peak works