bugs.mux1337.de

Security Disclosures

Coordinated vulnerability disclosures by Marvin (mux1337). This site tracks the status of security findings I have reported to vendors. Technical details are published only after the vendor has shipped a fix or the coordinated disclosure window has closed — see the disclosure policy.

Active work

All current engagements are under active coordinated disclosure. Entries appear here once a report has been filed, and technical details only after the conditions in the disclosure policy are met. Until then, no target, project, or technique information is published.

Questions about a specific report? Vendors can reach me via /.well-known/security.txt.

Principles

Private reporting first — no public issue trackers, no exploit publication before the fix.
Vendor gets a reasonable, stated window to remediate (default 90 days).
Details are published here only after the fix is live or the window closes with agreement.
Good-faith research only: no disruption, no data exfiltration, no targeting beyond program scope.

Full text: Disclosure policy · Machine-readable: /.well-known/security.txt