What people ask us first.
Most of these arrive the morning after a disclosure. If yours isn’t here, a researcher will answer it.
You received a disclosure
Is this email really from grey0?
Every disclosure carries a reference signed for your domain. Check it here. We never ask for payment, logins or remote access, and we never attach executables.
Did you break into our systems?
No. Our agents only read what your servers already hand to anyone on the internet, and they stop at the smallest proof that settles the question. We don’t log in, guess passwords or run exploits.
Did you test the exploit against us?
No. For a flaw like PHP2Shell we read the version your server announces, confirm it from a second network, and check whether your distribution backported the fix. If a vulnerability can only be confirmed by exploiting it, as with Log4Shell, we say so and leave the test to you.
What do you want from us?
That you fix it. Disclosures are free and come with the change that closes them. If you want us watching continuously we can talk about that, but a disclosure never depends on it.
Who else knows about this?
You, and the researcher who signed it off. We hold findings for 90 days by default, extend when you’re making progress, and never publish anything that identifies you without your consent.
Can you confirm it’s fixed?
Yes. Reply to the disclosure or press re-test in the email. The same agent repeats the original request and you get the result in writing.
What if you’re wrong?
Tell us. A version string can be misleading when a vendor backports a patch without changing it. Reply with your package version and we re-check, correct the record and thank you.
How we work
How do you find exposures?
Agents re-read the public internet continuously and compare it with what they saw before. When an advisory lands, they return to the hosts that match it instead of scanning everything again. The methodology walks through one case minute by minute.
How do you choose who to tell?
The contact in your security.txt first. Without one, the most senior security address we can verify, then your hosting or domain provider. Never a public channel.
Do you publish findings?
We publish methods and aggregate numbers, never anything that identifies a company. When a finding is fixed, the only lasting record of it is yours.
Can we ask you to stop looking?
Yes. Send us the domains. We’ll stop proactive checks on them, though we may still tell you about exposures we see elsewhere that affect you.
What does it cost?
Disclosures cost nothing, ever. Continuous coverage of your own estate is a paid engagement. Ask a researcher.