Evidence. Impact. Coordination.
Technical depth and professional judgement belong together.
Understand the boundary
Identify the target environment, starting privileges and conditions required to trigger the behaviour. Separate unexpected behaviour from a demonstrated security consequence.
Make it reproducible
Provide focused reproduction steps, a reliable proof of concept where appropriate and an explanation of root cause. State both the observed impact and the limits of the evidence.
Coordinate with the affected maintainer
Report through the designated security channel, share the evidence needed for validation and remediation, and coordinate the release of technical details with care for affected users.
Publish with context
Attribute the work, link primary sources and explain relevant fixes. Correct errors transparently. Unpublished research and confidential correspondence stay outside the public research archive.
This statement is not a vulnerability disclosure programme, safe-harbour promise or permission to test any system.