Advisories
If an assessment turns up something in a vendor's product rather than in a customer's configuration, the vendor hears about it first, on a 90-day clock. Nothing from a customer engagement is ever published.
None currently published. Advisories appear here once the disclosure window closes, with the full timeline, the affected versions, and the reporter credited unless they ask otherwise. We would rather show an empty list than pad one.
Findings from customer engagements are never published. Those belong to the customer, and nothing from an assessment leaves it without written permission.
Day 0
Acknowledged within one business day. A named engineer owns it from that point.
Day 0–7
We reproduce, assess severity against real blast radius, and confirm scope with the reporter.
Day 7
For issues in third-party systems, the affected vendor is notified privately with a full reproduction.
Day 90
Default publication date. Extended where a vendor is engaged and shipping a fix; shortened where the issue is being exploited.
Weakness classes, not products — the things an assessment looks for first.
Email security@guardra.ai. Include a reproduction, the version, and how you would like to be credited.
A report is not a press strategy — it is a reproduction, a suggested fix, and someone who will stay on the call. If a fix needs longer than 90 days for a certification cycle or a fleet rollout, say so and it gets extended.
If a fix needs longer than 90 days for a good reason — a certification cycle, a fleet-wide rollout, a clinical validation — tell us and we will extend. We have never published against a vendor that was engaged and moving.