The people who made us harder to break.
Researchers who reported real, valid vulnerabilities under our Responsible Disclosure Policy are credited here, with honourable mentions for reports that helped without qualifying for full credit. There is a lighter list too: breach claims that turned out to be one of our decoy sandboxes, where our agents played along. Recognition is how we say thank you. We do not pay for reports.
- Researchers credited
- 0
- Valid reports fixed
- 0
- Critical / High
- 0
- Decoy catches
- 0
Hall of fame.
Real issues, found by researchers, confirmed by us and fixed in production.
This spot is open.
No one has been credited yet. Find a valid, in-scope issue, report it responsibly, and your name can be the first one here.
Read the policyReports that helped.
Not every useful report is a vulnerability we can credit in full. These researchers still made Safeguard better: a duplicate sent in good faith, a hardening suggestion we acted on, or a low-impact issue we fixed anyway.
No honourable mentions yet.
Reports that help without qualifying for full credit are listed here, with the researcher's consent.
Not every breach is a breach.
Some of what looks like Safeguard is a decoy: an isolated sandbox full of synthetic data, with agents that are happy to play along. These claims all landed in one. No customer data or production system was involved in any of them.
Nobody has taken the bait yet.
Or nobody has admitted it. When a breach claim turns out to be one of our decoys, it shows up here.
How to get on this page.
Every credit here started with a private report. The full rules are in our Responsible Disclosure Policy. This is the short version.
- 01
Report it privately
Email security@safeguard.sh with the issue, the steps to reproduce and the impact. Not on social media, a forum or GitHub.
- 02
Stay in scope
Test only the surfaces the policy lists, against resources you own. No denial of service and no social engineering.
- 03
Keep it confidential
Safe harbour covers good-faith research that stays private until we have shipped a fix or agreed a disclosure date with you.
- 04
Get credited
Once the fix ships, a valid report is listed here under the name and link you choose. We do not pay for reports.
Our response times
- Acknowledgement
- Less than 1 business day
- Triage
- Less than 5 business days
- Fix
- Severity-dependent
Who gets listed.
Included when
- The report was valid, in scope, and reproducible under the Responsible Disclosure Policy.
- It was the first report of that issue.
- The fix has shipped to customers.
- The researcher consented to public credit, under the name and link they chose.
Not included
- Duplicates of an issue already reported or already known internally.
- Out-of-scope surfaces or findings listed as not covered by the policy.
- Automated scanner output with no demonstrated impact.
- Reports made in breach of the safe-harbour terms, including public disclosure before a fix.
Honourable mentions
- The report helped, but did not meet every condition for full credit.
- Typical cases: a duplicate sent in good faith, a hardening suggestion we acted on, or a low-impact issue we fixed.
- The researcher consented to being named, under the name and link they chose.
Caught in the sandbox
- The activity reached one of our decoy environments, not production.
- The entry describes the claim and what was actually reached, not the person.
- A name or handle appears only if the person used it to make the claim in public.
- Anyone listed can ask us to review their entry at security@safeguard.sh.
Before you post about it
Publishing a real finding before it is fixed, or presenting a decoy hit as a breach, is outside our disclosure policy and, in any medium, can carry legal liability where the law of the country concerned provides for it. The terms are in the legal notice of our disclosure policy.
Found something? Tell us first.
Email security@safeguard.sh with steps to reproduce and the impact. Tell us how you would like to be credited.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.