Thanks to security reporters

We pay no bounty. What we offer is credit on this page - the finding, the date it was fixed and, if you want it, your name.

Credit only where it was asked for. The report form has a field for it. Whoever leaves it unchecked appears here without a name: the finding counts, not the name. We do not ask again, and we never add a name later - people who report a vulnerability often have good reasons to stay unnamed.

An entry appears only after the fix. Before that it would be an open vulnerability with a description, and that is a manual.

The short description names the kind of finding, never the route to it.

Withdrawing your credit

The credit rests on your consent, and consent can be withdrawn at any time - including when your name is already published here. You need not give a reason or explain anything to us.

How: Write to us quoting your case number (it is in your acknowledgement, in the form GS-YEAR-XXXXXX). The number is enough - you do not have to repeat your name in order to have it removed.

We remove the name without undue delay. The entry itself stays, then without a name: the finding still counts, only the attribution to you falls away. Withdrawing changes nothing about your report and carries no disadvantage for you.