Sherlock Forensics Labs: Responsible Disclosure Tracker

Sherlock Forensics Labs operates on the 90-day coordinated disclosure model. When our research surfaces a vulnerability in a vendor product, we notify the vendor on day zero with full technical detail. The vendor has 90 days from acknowledgement to ship a fix before public disclosure. If the vendor confirms a fix earlier we publish at vendor approval. If 90 days elapse without a fix we publish on schedule.

Our public stance during the disclosure window is minimal. We acknowledge the existence of the finding, the vendor and product affected, the high-level vulnerability class and a status indicator on the disclosure timeline. We do not publish proof-of-concept code, exploitation specifics or technical details that would enable an attacker before affected users have remediation available.

Researchers and incident response teams who need pre-release notification under NDA can reach the lab at labs@sherlockforensics.com. Coordinated-disclosure peer review by other vendor security teams is welcomed.

Ryan Purita is the Principal Security Consultant at Sherlock Forensics and the lead researcher for Sherlock Forensics Labs. Ryan holds CISSP, ISSAP and ISSMP certifications and has 20 years of digital forensics and security research experience. His prior work includes courtroom-tested forensic examination for civil and criminal proceedings, security advisory engagements for legal and enterprise clients across North America and original vulnerability research published through the Sherlock Forensics platform.

Lab disclosures are reviewed by the Sherlock Forensics technical team before vendor notification and again before public release. See the broader Sherlock Forensics About page for the research team background.