Check a disclosure is ours.

Every grey0 disclosure carries a reference signed for your domain. Enter the reference and your domain at https://grey0.com/verify. If the signature doesn’t match, the email didn’t come from us.

Reading a reference

A reference looks like G0-2026-4QMV8R-T7WD2KXN5H: the prefix, the year, a code unique to one finding, and a signature. The last part is a signature over the rest and your domain. Nobody can make a valid one without our key. That reference is a reserved sample: the checker always names it as a sample, never as genuine.

A real disclosure never asks for

• Payment. Disclosures are free. Anyone asking for money to reveal or fix a finding is not us.
• Logins or passwords. We will never ask you to sign in anywhere or to share a credential.
• Remote access. We don’t need access to your systems, and we will never ask you to install anything.
• Files to open. Evidence is text and screenshots. We never attach executables, macros or archives.

Still unsure?

Ask before you act. Talk to a researcher or read the questions.