Responsible disclosure

Clear boundaries make better research

Shultis Labs publishes methods and reviewer-safe summaries while coordinated disclosures remain private.

Testing scope

• Researcher-controlled accounts and synthetic or inactive test data.
• Read-only observation where possible, with the smallest harmless state change needed to verify a claim.
• Fresh identifiers, recorded pre-state, controlled timelines, and preserved original evidence.
• No unsolicited testing of third-party accounts, real credentials, private communications, or production data.

Reporting practice

Reports are sent to the affected vendor through its vulnerability-disclosure channel. Public notes describe the method and evidence boundary without publishing operational payloads, vendor-confidential correspondence, or sensitive values before coordination is complete.

Claims are labeled according to the evidence available. A network callback is reported as a callback; a persistent native-product mutation is supported with the product’s own history, activity records, and ownership metadata.

Contact

For security matters, contact [email protected]. Please do not send active passwords, recovery codes, API keys, or other live secrets.