Responsible Disclosure Policy

1. Principle of Coordinated Disclosure

HexShield Research follows an industry-standard 90-day coordinated disclosure timeline. When our research teams discover zero-day vulnerabilities in third-party software, firmware, or hardware products, we immediately provide encrypted private notification to the affected vendor before publishing details in our public database.

2. Active Exploitation in the Wild

If a vulnerability is discovered to be undergoing active, unmitigated exploitation in the wild by malicious adversaries prior to the expiration of the 90-day embargo, HexShield reserves the right to expedite publication of defensive detection rules and mitigation workarounds within 7 calendar days to protect end-user systems.

3. Safe Harbor for Security Researchers

We advocate strongly for the legal protection of ethical security researchers acting in good faith. If you conduct security research in compliance with this policy:

• We will consider your research authorized and will not initiate legal action for accidental good-faith violations.
• We will work directly with you to understand and validate your vulnerability findings.
• We will grant full public credit and attribution upon public CVE publication.

4. Reporting a Vulnerability to HexShield

To submit a vulnerability report for peer review or coordination, email our encrypted inbox at [email protected]. Please include reproducible test instructions, affected versions, and any suggested remediation.