All offensive work is contracted and authorised. Operators use callsigns only (Ivxx–Vxx). Zero-knowledge report storage and crypto/XMR billing available for sensitive private engagements.
Research showcase with redacted details under coordinated disclosure. External researchers: follow the responsible disclosure policy below.
| ID | Title | Status | 90-day clock | CVE |
|---|---|---|---|---|
SSD-ADV-2026-001 | Coordinated disclosure: auth bypass in popular CMS plugin family | embargoed | 41 days | CVE pending |
SSD-ADV-2026-002 | Memory corruption in niche IoT gateway firmware | vendor_notified | 67 days | CVE pending |
SSD-ADV-2026-003 | Auth token confusion in niche SSO bridge | vendor_notified | deadline 2026-12-15 | CVE pending |
SSD-ADV-2026-004 | Unsafe deserialization in industrial HMI helper service | embargoed | deadline 2026-11-28 | CVE pending |
SSD-ADV-2025-019 | Privilege escalation via misconfigured cloud IAM role chaining | published | — | CVE-2025-XXXXX (redacted sample) |
Email [email protected] with encrypted reports (see /pgp). We aim to acknowledge within 3 business days and coordinate a 90-day window unless vendor agrees otherwise. No bounty programme yet — recognition on this page after publish.