Disclosure
Coordinated disclosure
Our researchers find vulnerabilities in the software we build environments from. We report each one to the people who can fix it, and we say nothing else about it until there is a fix to point at.
Disclosure records
After a fix is released, we publish the affected component, fixed version, and advisory or CVE identifier.
View advisoriesReporting something to us
If you found a vulnerability in XOR software or a third-party component we study, or have a CVE ID request to coordinate, email security@xor.tech.
Send a brief initial message. We will arrange a secure channel for technical details and coordinate disclosure with you.