Submit a vulnerability disclosure →
Overview
NC4 encourages responsible vulnerability disclosure for systems that affect Kenya's digital ecosystem.
Submissions should be factual, reproducible, and made in good faith.
Definitions
Coordinated Vulnerability Disclosure (CVD): A structured process for receiving, validating, and remediating reported security weaknesses.
Reporter: The individual or organization sharing a vulnerability report.
Responsible disclosure
- Do not access or alter data beyond what is necessary to verify the issue.
- Avoid service disruption, privacy violations, and unauthorized system changes.
- Provide adequate evidence so remediation can be prioritized.
What details should a vulnerability report include?
Include affected asset, technical impact, reproduction steps, and any supporting evidence such as logs or screenshots.
Will NC4 acknowledge submissions?
Yes. Valid reports are acknowledged and routed through coordination workflows for appropriate follow-up.
Here to help
Something doesn’t look right?
Prepare an incident report with the details that matter.