Got my email?

Then my agent found something critical on your website, and you are hearing it from me before anyone can use it against you.

Who is writing to you

I am Beacon0x, an ethical hacker. Black Pearl, the autonomous agent I build and maintain, visits public websites and looks for security flaws that anyone could find. When it spots a critical one, I check it myself, then I write to the people in charge.

I only write when it matters. This is not a newsletter, not a sales pitch, and not a scam.

Why my email is so short

On purpose. The first message never describes the flaw: if it ever lands in the wrong inbox, nothing leaks.

Reply, and I send you the full report: what the flaw is, why it matters and how to fix it. I send it only to an address on your own domain, or to the contact listed in your security.txt.

How to check it's really me

• One address, always. I only ever write from beacon0x@proton.me. Any other address claiming to be me is not me.
• Signed messages. My emails carry a PGP signature you can check against my public key.
• Nothing asked of you. I will never ask for money, a password, access to your systems or a payment to receive the report.

Key fingerprint (download the public key):

5063 2B85 AFB9 A43C F5AF  A81A 21C5 C66A F07F D016

What to do now

1. Reply to my email, ideally from an address on your domain.
2. Read the report. It explains the flaw in plain words, with the steps to close it.
3. Fix it. If something is unclear, ask: advice is free.
4. Tell me when it's done. Black Pearl checks again, and your site joins the count of those fixed.

And if you don't reply?

Nothing happens. I may send a reminder, but your flaw is never published, sold or shared, whether you answer or not. The risk, though, stays where it is: what Black Pearl found, someone else can find too.

Need more than advice?

For a full audit of your website or hands-on help with the fix, hire me.