Last updated 4 November 2026
If you find a security problem in this website or in anything else nandsec runs, email [email protected] or message us on Signal or SimpleX. Include what you found, where it is and the steps to reproduce it. Plain text is fine, and the same contact is published in security.txt at /.well-known/security.txt.
When testing, use only your own accounts and data, and stop as soon as you have shown the problem. Do not run denial of service, spam or social engineering against us. If you come across someone else's personal information, stop there, keep no copy and tell us in your report. Keep your findings private until we have fixed the problem.
We acknowledge every report within two business days, confirm or decline it within seven days and fix a confirmed problem within 90 days. If you want credit, we name you in the fix notes. If you make a good faith effort to follow this policy, we treat your testing as authorised and take no legal action against you, including over a mistake you tell us about. If someone else takes legal action against you over research that followed this policy, we will confirm that it did.
When our research finds a vulnerability in another vendor's product, we report it to the vendor in private and allow 90 days for a fix. If the vendor shows that a fix is in progress, we extend this once, by up to 30 days. If the vulnerability is already being exploited, we shorten it to seven days. If the vendor has not replied within 45 days of our report, we ask ASD's ACSC to coordinate the disclosure.
We publish an advisory when the vendor releases a fix or when the disclosure period ends, whichever comes first. It names the product, the affected versions and the fix, and leaves out exploit code that would put unpatched systems at risk. We request a CVE for every confirmed vulnerability, unless the affected project's published rules treat the issue as a regular bug.
Findings from a client engagement are confidential to that client, and we publish nothing from the work without their written agreement. If we find a vulnerability in a third-party product during an engagement, we report it to the vendor only with the client's agreement.