Responsible Disclosure

Effective: 11 August 2026

Before reporting

Do not conduct scanning, exploitation, persistence, denial of service, social engineering, data access, or privacy-invasive testing against RedCore systems without prior written authorization. If you encounter a suspected issue during ordinary use, stop and preserve only the minimum information needed to describe it.

Initial report

Use the contact form, choose “Security disclosure,” and provide only a high-level description, affected public URL or product area, observed date, and a safe way to contact you. Do not submit credentials, personal data, exploit code, or sensitive evidence through the form.

Secure follow-up

RedCore will acknowledge the initial report and, where appropriate, provide a designated secure transfer method before requesting technical evidence. Response and remediation timelines depend on severity, reproducibility, affected customers, and operational risk.

Coordinated disclosure

Please allow reasonable time for validation and remediation before public disclosure. RedCore will not promise rewards, safe harbor, or legal treatment outside a written agreement.