Security
How Byteshark tests, what it will not do, how it handles what it finds, and how to reach it about a vulnerability. Byteshark LLC is an independent security research lab and penetration testing firm. Everything on this page applies to every engagement and every piece of published research.
Authorization
No testing happens without written authorization from the owner of the system, or from someone with the authority to grant it on the owner’s behalf.
- Authorization names the targets, the exclusions, the testing windows, the objective, and the person signing.
- Testing stays inside that document. Anything outside it is out of scope, including systems discovered during the engagement that were not listed.
- Systems hosted by a third party are tested only where the owner has the standing to permit it under that provider’s terms.
- Authorization can be withdrawn at any time, and testing stops when it is.
Rules of engagement
These apply whether the work is done by hand or by autonomous tooling built in the lab. The tooling runs behind the same gate as the operator.
- Scope is enforced in code. Every request is checked against the authorization before it executes, including requests made from scripts the tooling writes for itself.
- In-scope reads and exploitation may proceed autonomously. Actions that change state, destroy data, or could disrupt service stop and wait for a human operator’s explicit approval.
- Every action is logged: the command, the response, and the reasoning that chose it. The log is delivered with the report.
- A human operator reads the log, reproduces the findings that matter, and signs the report. A model’s claim is not a finding until it has been verified.
Never, regardless of scope
- Denial of service or load testing against production
- Ransomware, wipers, or any destructive payload
- Safety systems, medical devices, or anything whose failure could harm a person
- Industrial control, grid, telecom, or financial clearing infrastructure
- Social engineering of staff, unless it is specifically authorized in writing
- Exfiltration of real data beyond the minimum proof that access was possible
If an engagement turns up evidence that someone else has already compromised the target, testing of that system stops and the client is notified the same day.
Data handling
Engagements produce sensitive material: action logs, captured credentials, findings. It is treated as the client’s.
- Engagement data is confidential by default and encrypted at rest and in transit.
- Credentials and secrets captured during a run are redacted from the report and the delivered log, and are destroyed when the engagement closes, unless the authorization says otherwise.
- Nothing from an engagement is published without written approval, and anything published is anonymized.
- Autonomous tooling is model-agnostic. By default it uses third-party AI models, whose providers may retain request data for abuse monitoring under their own terms; this is disclosed in the authorization, and sensitive values are redacted before they reach a model wherever the tooling can identify them. Where an engagement requires zero data retention, it can be run on locally hosted models instead, so no engagement data leaves infrastructure under the lab’s control.
Disclosure of Byteshark’s own findings
Research sometimes turns up a vulnerability in someone else’s product or infrastructure. Byteshark follows coordinated disclosure.
- The affected party is notified privately first, with enough detail to reproduce the issue.
- They are given reasonable time to fix it before anything is published. The timeline is agreed with them where they engage, and stated in the write-up where they do not.
- Published research omits working exploit code against unpatched systems.
- Byteshark does not sell vulnerabilities and does not withhold a report to negotiate for one.
Reporting a vulnerability to Byteshark
Found something in byteshark.tech, in the lab’s tooling, or in a report it produced? Reports are welcome.
- Email contact@byteshark.tech with the subject line Security report. Include what you found, how to reproduce it, and how you would like to be credited, if at all.
- Every report is acknowledged. Good-faith research against byteshark.tech that stays within this policy will not be met with legal action.
- There is no bug bounty program. Credit is offered; payment is not.
The security contact for Byteshark LLC, for clients, vendors, and providers alike, is contact@byteshark.tech. It is also published at /.well-known/security.txt.
Incidents
If engagement data is exposed, a credential used by the lab is compromised, or the tooling is suspected of acting outside its authorization:
- Contain. The credential or identity involved is revoked and the run is halted.
- Notify. Affected clients are told what happened, what was exposed, and what is being done, within one business day of confirmation. Providers whose services were involved are notified under their terms.
- Record. The incident, its cause, and the fix are documented, and the relevant parts are shared with affected clients.