Authorization before testing
Research must stay within an explicitly permitted scope. Ownership, test boundaries, and applicable program rules are established before work begins.
Security & accountability
Security has
a clear owner.
Sebastian Griego leads Griego’s security function. Responsibility for security decisions, research scope, and vulnerability handling sits with an identified lead.
Security Lead
Sebastian Griego
Sebastian leads Griego LLC’s cybersecurity research practice and owns its security function. His responsibilities include research authorization, security risk decisions, vulnerability triage, and coordinated disclosure.
Contact Sebastian- Company
- Griego LLC
- Function
- Cybersecurity research
- Accountability
- Security Lead
Governance principles
Defined boundaries.
Visible responsibility.
These principles guide how Griego scopes research, handles sensitive information, and coordinates security concerns.
Minimum necessary access
Access should be limited to what the research requires. Sensitive data should not be collected or retained beyond what is necessary to document an issue responsibly.
Evidence with context
Security conclusions should be supported by reproducible observations, with scope, impact, and uncertainty made clear.
Coordinated handling
Potential vulnerabilities should reach the responsible owner through a private reporting channel. Publication decisions should consider remediation and the risk to affected users.
Documented website checks
Evidence you can inspect.
Our first technical note records public HTTPS behavior, response headers, and the reporting channel on griego.co. It includes dated observations and a reproducible verifier. This limited website review does not verify private account controls or certify overall security.
Read the public website baselineFound something?
Report a security concern.
Our disclosure policy explains the reporting channel, expected information, and testing boundaries for this website.
Disclosure policy effective October 7, 2026. See the policy for research boundaries and reporting.
General inquiries