Disclosure policy

Version 1.0. Effective date: 9 November 2026. Written 7 November 2026.

What this covers

Most Lab research describes how a device behaves. Occasionally a result shows a security or privacy weakness in a product we do not control. The first part of this policy covers those cases. The second part covers weaknesses that other people find in this website.

When we find a weakness in someone else’s product

1. Report to the vendor first. We send the details to the vendor’s security contact. We keep the report private until publication.
2. The default period is 90 days from the day we report. If the vendor releases a fix within that time, we publish the details 30 days after the fix reaches users, or sooner if the vendor agrees.
3. Extensions. If the vendor tells us a fix will ship within 14 days of the date, we wait 14 more days. We agree longer periods only for a good reason and in writing.
4. Active attacks. If the weakness is already being used in attacks, the period is 7 days, so that users can protect themselves.
5. Publish. After the date, or sooner if the issue is fixed or already public, we publish what we found, with the vendor’s reply if they gave one.
6. Correct. If we got something wrong, we correct the article and say what changed.

We follow the model of the 90-day policies used by large research teams such as Google Project Zero (90 days, plus 30 days after a fix, and 7 days for attacks in the wild). We do research on our own devices and on synthetic data, and we do not test other people’s systems.

What we do not publish

• Working exploit code for a weakness that has no fix.
• Personal data from any device, including test devices that held real accounts.
• Detection rules, intelligence packs and detection logic of SectraTEK products. Those are not research findings and are not part of this site.

If you have found something in this website

Write to research@sectratek.com and describe the problem: where it is, how to repeat it, and what you think it allows. If your report contains sensitive details, tell us in a first short message and we will agree a safe way to send them. Please do not include personal data.

What we do. We acknowledge your report within 5 business days, tell you what we decide, and tell you when it is fixed. With your permission, we credit you in the corrections log. We do not pay rewards.

In scope: the pages and forms on lab.sectratek.com. Out of scope: other websites, the services that host this one (Amazon Web Services and others), denial-of-service tests, social engineering, physical attacks, and reports from automated scanners that show no real effect.

Safe harbor for good-faith research

If you follow this policy in good faith, we consider your research authorized. We will not take legal action against you for it or ask anyone else to, and if someone else does, we will say that your research was authorized under this policy. Good faith means that you:

• test only the in-scope pages and forms, and only as far as needed to show the problem;
• do not read, change, copy or keep other people’s data, stop at once if you see any, and tell us;
• do not disrupt the site, send spam, or harm anyone;
• report to us first and give us reasonable time, 90 days by default, to fix the problem before you tell anyone else;
• do not demand payment or anything else in exchange for silence.

This promise covers our own site. It cannot cover the rules or claims of other parties, and it does not allow you to break the law in ways that harm other people.