Trust Center
Vulnerability disclosure policy
We welcome responsible disclosure of security vulnerabilities. Researchers acting in good faith are protected under the safe-harbor provisions of this policy.
Scope
This policy applies to:
- The winstonandmiller.com website and all subdomains operated by Winston & Miller
- Any application, API, or service directly operated by Winston & Miller
This policy does not extend to third-party services, infrastructure, or software we do not directly operate. Reports about third-party components should be submitted to the respective vendor.
Safe-harbor policy
Winston & Miller will not pursue civil or criminal legal action against researchers who discover and report vulnerabilities in accordance with this policy and act in good faith. We consider research conducted consistent with this policy to constitute authorized access.
To qualify for safe-harbor protection, your research must:
- Access only data necessary to demonstrate the vulnerability
- Not exfiltrate, modify, or destroy data
- Not disrupt the availability of services
- Not conduct social engineering or phishing of Winston & Miller personnel
- Not publicly disclose the vulnerability until we have had a reasonable opportunity to remediate
How to report
Send your report to:
jessica@winstonandmiller.comUse “Security Vulnerability Report” as the subject line. You may request PGP encryption for sensitive reports.
Please include in your report:
- A clear description of the vulnerability
- Steps to reproduce, including any required conditions
- The potential impact if exploited
- Any proof-of-concept code or screenshots (if relevant and safe to share)
You may request not to be publicly credited. If you do want credit, let us know your preferred name or handle.
Response commitments
- Acknowledgment
- Within three business days of receiving your report.
- Initial assessment
- Within ten business days — we will confirm whether we can reproduce the issue and provide a severity assessment.
- Status updates
- We will keep you informed of progress toward remediation at reasonable intervals.
- Remediation
- We aim to resolve critical vulnerabilities within 30 days and high-severity issues within 60 days. More complex issues may require additional time; we will communicate any delays.
Related trust resources