Disclosure policy
The rules, written down before the first advisory.
ECHOS, the research program at Stonepath IT, looks for vulnerabilities in other people's software. These are the commitments it keeps when it finds one, and this is where to tell us if you find one in ours.
Disclosure policy
What this covers
ECHOS research into public, third-party software, and reports about the systems Stonepath IT runs, this site included. It does not cover work for a client: findings from an engagement go to the client, under that engagement's written terms.
When ECHOS finds something in your software
-
The vendor or maintainer hears about a finding from us, privately, before anyone else does.
-
The default embargo is 90 days from first report. It extends when a fix is genuinely underway and shortens only if the issue is being actively exploited.
-
Nothing about a finding is published, or hinted at, before its embargo expires.
-
The maintainer is credited in the advisory when it publishes.
-
ECHOS advisories: Vulnerabilities in self-hosted MCP servers and agent infrastructure, published after vendors have had time to fix them. Each ships with the reproduction, the CVE or GHSA identifier, and the timeline. Q4 2026.
Where a finding is filed
Findings in third-party MCP servers are routed through GitHub Security Advisories (GHSA) and the CVE program.
A GHSA is a GitHub security advisory: it starts as a private report to the project's maintainers and is published when the issue is disclosed. A CVE is the public identifier an advisory is filed under, so the issue has one name wherever it is tracked.
Reporting a vulnerability to us
Send reports to help@stonepathit.com.
Say what you found, where it is, and how to reproduce it.
Safe harbor
If you research our systems in good faith and report what you find to us, we will not take legal action against you for that research.
Good faith means you go only as far as you need to show the problem, you do not change, delete or keep anyone else's data, you do not degrade the service for anyone else, and you give us a reasonable chance to fix it before you tell anyone else.
It covers the systems Stonepath IT runs, and it cannot speak for anyone else: Cloudflare, which hosts this site, and Google's Gemini API, which answers Red Squirrel on the home page, set their own rules.
Last updated 26 September 2026
Checking us before you hire us?
Good. Reading the rules first is the right order. The next step is a scoping call.