Secure the internet.

Why you received a message

One of our agents found something exposed to the public internet on a domain your organization owns. We wrote to you privately so your team can review it and close it. We did not tell anyone else, and we did not publish it.

What the program checks

The program looks only at what is already visible from the public internet:

• A service reachable from the internet that was not meant to be.
• An administrative interface open to anyone who finds it.
• A development or debugging tool left running in public.
• A directory listing serving files that were never meant to be served.
• A default deployment page still in place on a live host.
• A similar misconfiguration that anyone could find the same way we did.

The agent takes only enough to name the affected domain or service and say what kind of problem it is. It does not go further in.

Open-source research

A notice reduces exposed attack surface. It does not fix the code underneath it. So the program also works at the source: we select one public open-source repository at a time and study it inside a disposable sandbox, looking for a security issue we can prove.

An agent asserting that something is vulnerable is not a confirmed risk, and neither is scanner output. Nothing counts until it reproduces, the fix holds, and both are written down well enough for someone else to rerun.

1. 01PinThe repository is cloned at an exact commit into a disposable sandbox that holds no production credentials.
2. 02BaselineThe project's own build and tests run before any research, so we know what was already passing.
3. 03ResearchThe agent reads and exercises the code inside the sandbox, against that one pinned revision.
4. 04ReproduceA candidate only counts once it reproduces from a clean checkout, with no leftover state from exploration.
5. 05PatchThe smallest reasonable fix, plus a regression test where the project makes one practical.
6. 06VerifyThe reproduction is re-run before and after the patch, and the project's own checks are run again.
7. 07ReviewA person accepts or rejects the result. Nothing leaves the lab automatically.

Tests are never deleted, skipped, or weakened to claim a pass. When the work does not clear the bar, the answer is no confirmed risk, recorded with what was attempted and what could not be checked. Either way the run produces the same package:

What the program does not do

• No password guessing, credential testing, or authentication bypass.
• No exploitation, destructive testing, privilege escalation, or vulnerability chaining.
• No collection of private files, customer records, source code, or authenticated content.
• No publication, sale, or public indexing of discovered issues.
• No testing of a live or hosted environment during research. Work happens against a local clone only.
• No forks, branches, commits, pushes, pull requests, or issues. The lab holds no repository write access.
• No maintainer contact, advisories, CVE requests, or bounty submissions made by the lab itself.
• No bulk scanning of public code hosts. Repositories are selected one at a time, deliberately.

Privacy and data handling

Notifications are sent directly to an appropriate public contact for the domain. The detection session is discarded after the message is delivered, and NullSquare does not maintain a searchable database of risks from this program.

Research runs work only against public source code. The sandbox is destroyed after the run, and the evidence package stays internal. If a result is ever taken to a maintainer, that is a separate and deliberate decision made by a person.

Minimal email delivery, abuse-prevention, and opt-out records may be retained separately. These records do not contain copied target data or exploit output.

Verify or respond to a notice

A legitimate Secure the internet message will never request credentials, payment, API keys, or access to your systems. You can reply to the message, request an opt-out, correct a contact, or verify its origin directly with NullSquare.