Security and vulnerability disclosure

How to report a vulnerability in our websites and tools, and what you can expect from us.

We advise manufacturers on vulnerability disclosure, so we hold ourselves to the same standard. If you believe you have found a security vulnerability in cetome.com, in one of our tools (CRAscoping, CRAted, FAST, ProSecCo, Auto VDP, RED scoping, RED self-assessment, REDact, ICS2IXIT) or in one of our research sites (dataviz, CRA Basics), we want to hear from you.

How to report

  • Email security@cetome.com, or use the contact form with “Security report” as the subject.
  • Tell us which site or tool is affected, the steps to reproduce, and the impact you see. Screenshots or a proof of concept help.
  • Our security.txt is published at /.well-known/security.txt, as recommended by RFC 9116.
  • Sensitive details can be encrypted with our PGP key, see below.

Encrypted reports

If your report contains details that should not travel in clear, encrypt it for security@cetome.com with our PGP key.

  • Download the public key: cetome-security.asc
  • Fingerprint: BA3F 45B4 928E DF7A 2C1A EE3A 3CB7 7CFA 4CE0 B1E0
  • Key: ed25519, created 13 October 2026, valid until 13 October 2029. Our security.txt carries the same fingerprint, so you can check one against the other.

Import the key with your PGP software, or on the command line:

curl -sO https://cetome.com/security/cetome-security.asc
gpg --import cetome-security.asc
gpg --fingerprint security@cetome.com

What you can expect

  • An acknowledgement within two business days.
  • An assessment and a fix or mitigation plan within thirty days for confirmed issues, sooner for critical ones.
  • Credit for the report, if you wish, once the issue is resolved.

Our commitments

  • We will not take legal action against researchers who act in good faith, respect this policy and the law, avoid privacy violations, data destruction and service disruption, and give us reasonable time to fix the issue before disclosing it.
  • We keep your report confidential and share it only with the people needed to fix the issue.

Out of scope

  • Denial-of-service testing, social engineering of our staff, and physical attacks.
  • Findings that only report a missing best-practice header without a demonstrated impact.