Responsible Disclosure Policy

Scope

PatchedLab runs a responsible disclosure program for vulnerabilities found in our own web properties (patchedlab.io and its subdomains).

What qualifies: Remote code execution, authentication bypass, sensitive data exposure, and similar high-impact findings.

What does not qualify: Denial of service, social engineering, issues in third-party services we don't control.

Reporting: Email findings to hello@patchedlab.io with subject line "[DISCLOSURE]". We aim to acknowledge within 48 hours and resolve within 30 days.

Safe harbour: We will not pursue legal action against good-faith researchers who follow these guidelines.