Set a disclosure deadline you cannot postpone

Choose a lock

Timelock. Timelock uses drand, a network that publishes public random numbers every three seconds. Your Postdate needs a future number to open. It relies on drand operators releasing that number on schedule. You cannot delete or postpone the message. Neither lock has an option to open early.

Timelock costs $3 USD per Postdate. This covers opening dates within one year and 100 MB including encryption and file packaging. Opening depends on drand and Postdate being available, and on the encryption remaining secure. Senders can keep original copies. Postdates can still expire or be removed for abuse. You see the price before you create the link. Read about Timelock.

Send it before it opens

You give a vendor 90 days to fix a problem. Around day 80, they ask for more time, then ask again. You have to decide whether to keep the deadline each time.

Publish the link now. Nobody can read the report through it before the agreed date. Then anyone with the link can read it. Postdate makes the report readable when it opens. You must share the link publicly for a public release.

Create your Postdate

1. 01

   Write the advisory with full technical detail.

2. 02

   Set the opening time to the agreed disclosure date.

3. 03

   Choose Timelock so the date cannot be moved.

4. 04

   Publish the link now, and send it to the vendor too.

Create a new Postdate Timelock: $3. No delete link.

Common questions

What if the vendor patches early?

The report still opens on the original date. Publishing after the vendor fixes the problem is the usual outcome.

What if the vendor needs more time?

You cannot postpone a Timelock message. With Standard, delete the message before it opens. Then create a new message for the later date. This lets you extend the deadline, so the original date is no longer guaranteed.

Does the vendor see the report before the deadline?

Send the report separately if the vendor needs it before the deadline. Most disclosure processes require this. The Postdate link sets when others can read the report.

More guides

End a security advisory embargo at a set time, Deliver a pentest report on a set date

Browse all guides or read about Postdate.