Advisories
In coordinated disclosure
Nothing is published until the fix is out.
Coming soon
Our first CVEs publish here.
Advisories are with maintainers now. Identifiers, reproduction steps and full write-ups appear on this page as each embargo lifts.
Disclosure policy
Maintainer first. Ninety days. No exceptions we don't agree to.
01
Found by the agent
A finding surfaces during a normal pass over an open-source project we depend on, or one our customers do.
02
Verified by hand
Our researchers reproduce it end to end and write a proof of concept before anyone is contacted.
03
Vendor notified
We report privately with the reproduction, and offer to review the patch. The clock starts here.
04
Published at day 90
Advisory and CVE go public after the fix ships, or at 90 days — whichever comes first.
Report to us
Found something in Zolt itself?
Send it to security@zoltsecurity.com with reproduction steps. We acknowledge within one business day, keep you updated through the fix, and credit you in the advisory unless you ask us not to.
◇Acknowledged within one business day
◇Credited in the published advisory
◇No legal action for good-faith research
Advisory list
Get each advisory the day the embargo lifts.
One email per advisory. Nothing else.
Get started free