Reproducible evidence
Tested versions, access requirements, state assumptions, trust boundaries, and observed results are stated explicitly.
COORDINATION & DISCLOSURE
Evidence before classification.
KECyber Security Research uses a repeatable process to validate findings, coordinate privately, and publish an accurate record—even when the vendor and researcher reach different conclusions.
OPERATING PRINCIPLES
What the record must preserve
Independent assessments
Vendor position, CVE status, and researcher conclusion remain separate fields. One does not silently overwrite another.
Minimum necessary detail
Public proof is sufficient to substantiate the issue without exposing credentials, customers, private correspondence, or live systems.
Durable attribution
Each publication receives a stable KECYBER-SA identifier and names the researcher responsible for the work.
FROM FINDING TO ADVISORY
The publication path
- 01
Validate privately
Reproduce in an isolated, owner-approved environment and test negative cases and postconditions.
- 02
Report and coordinate
Provide the affected vendor with technical evidence and a reasonable opportunity to investigate and remediate.
- 03
Resolve publication state
Record embargo terms, vendor response, fix availability, CVE state, and the basis for publication.
- 04
Sanitize and publish
Remove private material, validate the advisory contract, and publish the public record in UTC.
DISPUTED FINDINGS
Disagreement is part of the record.
A vendor may acknowledge observed behavior while disagreeing that it represents a vulnerability. When publication is permitted, KECyber presents the vendor's position alongside the researcher's technical assessment and the exact point of disagreement.
Material corrections are dated. Stable advisory identifiers are not reused, and substantive changes remain visible through the updated date.