Vulnerability Disclosure Policy

How to report vulnerabilities. How we handle them.

Bombadil Systems conducts original security research focused on format destruction, detection evasion, and the assumptions underlying modern security controls. We believe coordinated disclosure makes the ecosystem stronger, and we're committed to handling vulnerability reports with the seriousness they deserve.

This policy applies to vulnerabilities discovered in Bombadil Systems tools and research, as well as vulnerabilities reported to us within our scope.

Reporting a Vulnerability

If you've discovered a vulnerability related to our tools, research, or within our area of expertise—format destruction, detection evasion, file format manipulation, and related attack surfaces—we want to hear from you.

Submit a Report

Use the form below to submit a structured report. This helps us triage faster and keeps the noise out. All fields marked with * are required.

Your Name

Contact Email *

Vulnerability Category *

Affected System / Software *

Estimated Severity *

Vulnerability Description *

Steps to Reproduce *

Proof of Concept File

Choose file or drag here Max 10MB · zip, txt, py, js, c, json, pdf, png, pcap, and more

PoC Notes

Existing CVE ID

Additional Context

Security Check *

Just making sure you're human.

I'd prefer to remain anonymous in any published advisory

We accept reports related to vulnerabilities in our published tools (currently Veriduct), as well as novel vulnerability disclosures within our scope involving format destruction, detection bypass through file structure manipulation, and semantic execution techniques.

What to Expect

We follow a 90-day coordinated disclosure timeline. Here's how it works:

1day

Acknowledgment. We'll confirm receipt of your report within 24 hours.

7days

Initial assessment. We'll provide an initial evaluation of the report, including whether it falls within our scope and our preliminary assessment of severity.

90days

Public disclosure. We target full public disclosure within 90 days of the initial report. If a fix or mitigation is available sooner, we may disclose earlier in coordination with the reporter. If exceptional circumstances require an extension, we'll communicate that directly.

Our Commitments

We commit to working with security researchers in good faith. Specifically:

No legal action against researchers who report vulnerabilities in compliance with this policy.
Transparent communication throughout the disclosure process. You'll know where things stand.
Credit and attribution to reporters in published advisories, unless anonymity is requested.
Timely response. We don't let reports sit in an inbox. If we said 24 hours, we mean it.

Scope

Bombadil Systems' research and scope covers vulnerabilities involving:

Format destruction and file structure manipulation
Detection evasion through semantic reinterpretation of file formats
Security control bypass via format boundary exploitation
Vulnerabilities in Bombadil Systems published tools (currently Veriduct)

If you're not sure whether a vulnerability falls within our scope, report it anyway. We'd rather triage a report that's close than miss something important.

Safe Harbor

If you conduct security research in good faith and in accordance with this policy, we consider your research to be authorized. We will not initiate or support legal action against you for your research activities, provided you make a good-faith effort to avoid privacy violations, service disruption, and data destruction during your testing.

The door is open. We'd rather know.

Last updated: February 2026 · Bombadil Systems LLC