Security

Responsible disclosure.

A safe first route for reporting a suspected security issue affecting Pegasus-controlled systems.

Request a scoping call

Who this helps

Built around a buying situation.

Security researchers
Clients and suppliers
People who identify a suspected Pegasus vulnerability

Useful when

The trigger is already visible.

A suspected vulnerability affects a Pegasus-controlled system
Non-destructive evidence is available
A safe reporting and coordination route is needed

The position

Report safely. Preserve evidence. Avoid harm.

Initial reports should identify the affected Pegasus-controlled asset, describe the suspected issue and explain a non-destructive way to reproduce or understand it. Do not access data that is not yours, degrade a service, use social engineering or expand testing beyond what is necessary to report the concern.

A defined scope and accountable decision owners

Controls matched to the real operating context

Evidence that can be reviewed, tested and improved

Scope

What the work includes.

Every engagement is scoped around authority, operating context, available evidence and the decision that must be made.

Non-destructive reporting

Send the minimum useful description, affected URL or asset, observed behaviour, date and a safe contact route.

Acknowledgement and triage

Pegasus will assess relevance, ownership, potential impact and the need for containment or specialist support.

Coordinated handling

Further testing, disclosure timing and communication require explicit coordination; no blanket testing permission is granted by this page.

Professional boundaries

Precision includes saying what the work does not claim.

Do not access data that is not yours, degrade services or use social engineering.
Do not send exploit code, credentials or sensitive records through the general enquiry form.

Questions answered

Before you scope the work.

Does this page authorise security testing?

No. It provides a reporting route. Any testing beyond passive observation or minimal non-destructive validation requires explicit written authorisation.

Should exploit code or credentials be emailed?

No. Begin with a minimal non-sensitive report and agree an appropriate secure transfer route if further evidence is required.

Start the conversation

Bring the exposure. Leave with a controlled route forward.

A first conversation is used to understand context, authority and the decision required—not to force a predetermined package.