Disclosure Guidelines

Whenever Cenzic identifies a vulnerability, we inform the vendor affected by the vulnerability so they can remediate the issue.  If the vendor doesn't return Cenzic’s notification within 10 days, Cenzic may choose to disclose the vulnerability to MITRE, FIRST, CSI, Vuln-Watch and other associations, including the press.  If the vendor communicates with Cenzic within 10 days and requests an extension to fix the vulnerability before Cenzic discloses the vulnerability publicly, Cenzic will work with the vendor to make reasonable accommodations.