Cliff's founder runs an active coordinated-disclosure practice. Some findings are published and named, and you can verify them yourself. Most are still under embargo with the vendor, so they appear here by class and severity only, never by target, until they're fixed. Here is the honest ledger.
A finding only counts if untrusted input can actually reach the flaw. We trace the path, not the version number.
Every claim is backed by a runnable proof we stood up ourselves. No target of yours is ever touched to make a point.
Nothing is reported until a named researcher has reviewed it. Proof, not payload, and never a false positive shipped to a stranger.
We disclose privately, help with the fix, and hold the details until it ships. That discipline is why this page stays honest.
A readiness assessment runs the same rigor against your estate, scoped and human-supervised from the first packet.