Responsible Disclosure
Last updated: October 24, 2026
Our commitment
Every security finding we produce — in a paid engagement or independent research — is handled the same way: reported directly and confidentially to the operator of the affected platform. We inform; the operator decides what to do next.
We do not publish findings, sell them, or share them with anyone other than the operator.
How we disclose
Findings are delivered through a direct, confidential channel to the operator — with reproduction steps, extracted evidence, severity scoring and concrete remediation guidance. Where the operator wants it, we walk through the report on a call.
We set no disclosure deadlines and apply no escalation pressure. Remediation is the operator's decision and timeline.
What we never do
No denial-of-service, no data modification, no persistence, no spam, no testing beyond the authorised scope.
No public write-ups naming operators, no disclosure countdowns, no leveraging findings for reputation. Discretion is part of the product.
Evidence handling
Where proving a finding requires real data, we extract the minimum sample that demonstrates impact — never more. Evidence is stored encrypted, used only in the report to the operator, and destroyed at the close of the engagement.
No user data obtained during testing is retained, published or misused.
Verification retest
After the operator remediates, we re-run the exact exploit path to confirm the vulnerability is genuinely closed — not merely obscured. This retest is included in every engagement.
Reporting a vulnerability to us
If you have found a security issue on auditis.ro, we want to hear about it. Email contact@auditis.ro with a description of the issue, its location, the potential impact and steps to reproduce.
We will acknowledge your report, investigate and act on confirmed issues. We ask only that you do not disclose the issue publicly before we have had a reasonable opportunity to look at it — the same standard we apply to our own findings.
