Griego LLC · Effective October 7, 2026
Griego LLC is establishing a cybersecurity research practice focused on vulnerability identification, controlled reproduction, and remediation for web applications and APIs. Our work will be limited to systems we own or are explicitly authorized to assess.
This page sets out the practice's research rules and reporting channel. Griego LLC was formed in Arizona on October 2, 2026. The policy effective date above identifies this policy's publication, not the beginning of an established research track record. Our dated technical notes distinguish completed observations from planned work.
Leadership and responsibility
Sebastian Griego, Security Lead, is accountable for Griego LLC's security function, including:
- Approving research objectives, system-owner authorization, and testing boundaries before work begins.
- Reviewing findings, proposed remediation, and any use of AI-assisted analysis.
- Reviewing security reports and coordinating with affected system owners.
- Approving disclosure decisions and maintaining this policy.
The security lead may pause or stop work when authorization is unclear, testing exceeds its agreed scope, or unexpected data exposure or disruption occurs.
Research scope and safeguards
Our planned research covers web application and API security: identifying potential vulnerabilities, validating findings in controlled conditions, and developing practical remediation guidance.
Before an assessment begins, we will document the systems in scope, the owner's authorization where required, permitted methods, and conditions for stopping work. Authorization for one system does not extend to connected services, third-party infrastructure, or other organizations.
We will reproduce findings in isolated test environments, using synthetic or appropriately minimized data wherever feasible. Testing a live system requires specific authorization and a review of the potential impact. We will collect only the evidence needed to substantiate a finding and avoid unnecessary access to credentials, personal information, or unrelated data.
Unexpected exposure or disruption will trigger a pause, notification to the responsible owner, and a review before work resumes. Sensitive evidence will be shared only with people who need it for validation, remediation, or coordinated disclosure.
AI-assisted research
We intend to use AI models to support authorized research, including analysis, controlled reproduction, and remediation development. Model access will be limited to approved, named users and locations permitted by the relevant provider and program.
AI outputs will be treated as unverified until reviewed by a person. The security lead remains responsible for research scope, validation, and disclosure. Model output does not provide authorization to test a system or replace confirmation of a finding.
Requirements before model-enabled research
Named individual accounts, multi-factor authentication, least-privilege access, protected credentials, and a documented incident contact are prerequisites for model-enabled research. Shared sessions and shared personal credentials are not permitted. Provider-specific controls must be checked before access is used, including any stronger authentication or short-lived credential requirements.
These are operating requirements, not a certification that every account control has been independently verified. Public website observations do not establish the security of private accounts. The security lead must record each control's evidence and any unresolved prerequisites before starting the relevant work.
Report a security concern
Send security reports concerning Griego LLC or our work to sebastian@sedy.mx. Sebastian Griego is responsible for reviewing reports received at this address.
Please include:
- The affected service or component.
- A concise description of the issue and its potential impact.
- Minimal reproduction steps or redacted evidence, if already available.
- A way to contact you for clarification, if you would like a reply.
Do not send passwords, access tokens, personal data, or large collections of sensitive records in the initial email. Ask us to arrange a suitable transfer method if sensitive evidence is necessary. A report does not need to contain an exploit or additional testing to be considered.
We will assess reports based on their potential impact, seek clarification when needed, and coordinate with the appropriate owner. Response and remediation timing will depend on the issue and the parties involved; we do not promise fixed response or resolution times.
Coordinated disclosure
We will share substantiated findings privately with the responsible system owner and work with that owner on remediation and disclosure timing. Before publishing technical details, the security lead will review the information for unnecessary exposure of sensitive data and the risk of enabling harm.
Please contact us before publicly sharing details of a concern affecting Griego LLC so that we can coordinate review and remediation.
Separate, explicit authorization from the responsible system owner is required before active testing. This page does not grant permission to test Griego LLC systems or any third-party system.
Policy maintenance
Sebastian Griego is responsible for reviewing and updating this disclosure as the practice develops. Material changes will be reflected in the effective date above.
For security governance questions, contact sebastian@sedy.mx.