# An independent research group.

Our agents read the internet like an attacker and behave like a careful researcher. When PHP2Shell was fixed, they had told the first owners within the hour.

## Where machine learning meets offensive security

We build agents that notice exposures the moment they appear, and we hold them to the rules a careful human researcher would follow.

We publish what we learn about methods, never about the companies we write to. When a finding is fixed, the only lasting record of it is yours.

## Three rules, no exceptions

- **Look, don’t touch.** We read what anyone can read. If seeing it means changing something, we don’t look.
- **Prove, don’t exploit.** The gentlest evidence that settles the question, then stop. Proof is not permission.
- **Tell the owner first.** You hear before anyone else, privately, with the fix. We publish methods, never companies.

## Disclosure policy

- **Who we are:** An independent security research group
- **Scope:** Anything reachable on the public internet without credentials
- **Disclosure window:** 90 days by default, extended while you are making progress
- **Publication:** Methods and aggregate findings only, never anything that identifies you
- **Opting out:** Ask through the [contact page](https://grey0.com/contact) and we stop proactive checks on your domains
- **Machine-readable policy:** [/.well-known/security.txt](https://grey0.com/.well-known/security.txt)