# Check a disclosure is ours.

Every grey0 disclosure carries a reference signed for your domain. Enter the reference and your domain at https://grey0.com/verify. If the signature doesn’t match, the email didn’t come from us.

## Reading a reference

A reference looks like `G0-2026-4QMV8R-T7WD2KXN5H`: the prefix, the year, a code unique to one finding, and a signature. The last part is a signature over the rest and your domain. Nobody can make a valid one without our key. That reference is a reserved sample: the checker always names it as a sample, never as genuine.

## A real disclosure never asks for

- **Payment.** Disclosures are free. Anyone asking for money to reveal or fix a finding is not us.
- **Logins or passwords.** We will never ask you to sign in anywhere or to share a credential.
- **Remote access.** We don’t need access to your systems, and we will never ask you to install anything.
- **Files to open.** Evidence is text and screenshots. We never attach executables, macros or archives.

## Still unsure?

Ask before you act. [Talk to a researcher](https://grey0.com/contact) or read [the questions](https://grey0.com/questions).