Disclosure process
The default disclosure window is 90 days from vendor notification. We provide the vendor with the scoped technical evidence needed to investigate the report.
One extension of up to 30 days may be granted when a fix is in progress. An approved extension and revised deadline are shown in the public register. Overdue records remain visible.
View disclosure clocksPublication and client confidentiality
Client engagement findings remain private and are not republished as research. Public advisories require separate review and publication approval.
Visit the advisory registerSecurity contact
Report a weakness in our systems
Email security@securepeak.com. Include the affected system, a description of the issue and a way to contact you. Encrypt sensitive details using the website public key.
Testing boundaries
We welcome good-faith reports and do not run a paid bounty. Contact us before testing that could affect availability, expose other people's data or exceed your authorisation.