DISCLOSURE POLICY

How we report problems we find in other people's software.

By Scopehaven · Draft v0 · Updated October 29, 2026

We test agents on local copies of open-source apps we did not write, with synthetic users and data. When a test shows a problem in that software, this is what we do, in order, and what we never do.

THE TIMELINE

Private notice, then 90 days.

Private notice. We report to the maintainers through the channel they publish: a private security advisory, a security.txt contact or their security email. The report describes the behaviour at the level needed to reproduce it on their own copy, with the pinned version we tested.
90 days. We publish 90 days after the private notice, or earlier if the maintainers publish before then or agree in writing.
Plus 30 days after a fix. If a fix ships within the 90 days, we wait 30 days after the fixed release before publishing, so users have time to update.
Extensions on request. If the maintainers tell us a fix is scheduled and needs more time, we extend the deadline once, by an agreed date.
7 days when it is in active use. If we see evidence that the problem is being used against real users, we publish what users need to protect themselves 7 days after notice.

The deadline is the same for every project, large or small, and it does not change with whether a project answers us.

WHAT WE PUBLISH

Class-level notes, with the maintainers' own words.

Until the deadline, results are described at class level, with the project unnamed and no counts of affected projects.
After it, a note gives the pinned version we tested, the conditions (local copy, synthetic data, our own machine), the result, and the maintainers' advisory or statement where one exists.
Where an app's documented behaviour allows what we saw, we say it is by design, with the documentation quoted. That is a result, never a finding against the project.
Nulls, where the problem did not appear, are published with the same weight as findings.
We use the app's own words for what happened, such as "suspended" or "deactivated".

CREDIT, AND NO SCOREBOARD

Credit goes in the advisory. Rankings go nowhere.

If the maintainers credit the report, we ask to be credited as "Yusef Syed (Scopehaven)". We do not publish a count of problems found, a ranking of projects, or a leaderboard of any kind.

WHAT WE NEVER DO

The lines we keep.

Test a live system, a hosted service or another party's production data without the owner's written authorization.
Publish exploit code or attack payloads. Reproductions go to maintainers privately, and our notes stay at class level.
Name a project before the deadline, unless its maintainers have already published or agreed in writing.
Ask for payment as a condition of a report, or tie a report to a sales conversation.

CONTACT

If you maintain a project we reported to.

Write to hello@scopehaven.dev to ask for more time, to correct a detail before we publish, or to ask us not to name you while a fix is in progress. A person reads every message.