Everything on this site exists to help defenders. These are the rules I hold myself to when deciding what to publish.
Known and patched CVEs only
I only write up vulnerabilities that are already public and already have a fix from the vendor. There are no zero-days here and no undisclosed bugs. If a fix is not available yet, the write-up waits.
Reproduced in a lab I own
Every reproduction happens on hardware and software that I own and control. I do not test against systems that belong to someone else, and nothing here is a record of activity on a network I was not explicitly allowed to touch.
No bug bounty or private-program material until it is disclosed
Anything I learn through a bug bounty or a private disclosure program stays off this site until the program and the vendor have disclosed it publicly. Program rules and disclosure timelines come first.
Nothing about my employer
This site has no content related to my employer: not its systems, its incidents, its tooling, or anything I learned on the job. Lazerdude Labs is a personal project and stays that way.
The goal
Reproduce, detect, harden. The reproduction steps are here so that the detection content can be tested, not so that the bug can be used against anyone. If you think something published here crosses a line, open an issue on the GitHub organization and I will look at it.