TRUSTWEDGERESEARCH POLICY
Responsible disclosure.
Our policy is to coordinate disclosure with the responsible maintainers, give them time to remediate, and publish only when doing so will not put people or systems at unnecessary risk.
Report privately.
Technical details are shared confidentially with the responsible maintainers through an agreed reporting channel. Testing stays within the authorised scope and uses synthetic data wherever possible.
Coordinate remediation.
Disclosure timing is agreed with the responsible parties, taking account of impact, remediation and deployment. Reproduction details and retesting support the fix.
Publish with care.
Any advisory is published only after coordinated disclosure is complete. Publication must respect confidentiality and exclude personal data, credentials and unnecessary operational detail.