Editorial policy
The rules we follow for every story we publish.
Responsible disclosure
We do not publish working details of a vulnerability that the affected vendor has not had a fair chance to fix. Write-ups about real targets must be disclosed through the program or vendor first, and published only with their permission or after the agreed disclosure date.
Authorised testing only
Techniques we describe are for systems you own or are explicitly authorised to test, such as a bug bounty program's published scope. We will not publish material whose main purpose is to harm people or systems.
Accuracy and corrections
We check technical claims before publishing. When we get something wrong we fix it and note the correction at the end of the story. Spotted a mistake? Tell us.
Independence
Sponsored content, if we ever run it, will be clearly labelled. Companies we write about do not review or approve stories before publication.
Contributors
Guest writers must disclose any relationship with the companies or products they cover. Pitches go through the write for us page.