DISCLOSURE POLICY

How a record gets made, and the rules this registry holds itself to.

Coordinated disclosure

Every record here is reported privately to the organization first, and only published after a disclosure window has elapsed without resolution. This registry follows the same convention the security industry applies to itself, for the same reason: private notice gives the responsible party a genuine opportunity to fix the problem before anyone else learns of it.

The default window is 90 days from the date of first private contact. A record can be published earlier only if the organization declines outright, and later whenever a good-faith remediation effort is under way — in which case the timeline records the extension.

The window

1. Day 0The request is made privately, to the organization's documented contact.
2. Day 0–90The window runs. Follow-ups are sent and recorded. The record exists in the registry but is not public.
3. Day 90If the matter is unresolved, the record becomes eligible for publication.
4. AfterThe record is published, and the day counter continues until the matter is resolved.

What this registry promises

Private notice first

No record is published that was not first reported privately.

Permanent citation

Identifiers are never reused or renumbered. A retired identifier keeps resolving.

No silent edits

A published record is never altered in place. Every change is a dated revision, visible on the record.

Right of reply

Any statement from the organization is published verbatim and unedited, at any time.

Prompt correction

Errors of fact are corrected as soon as they are established, and the correction is recorded.

Withdrawal, not deletion

A record shown to be unfounded is withdrawn visibly. It is not quietly removed.

What is recorded

A record states what was asked for, when, of whom, and what happened next. It reports the response received — including its absence — as a fact with a date attached. It does not attribute motive. Where an organization has explained itself, the explanation is published in its own words alongside the record.

Severity describes the effect on access, not the intent behind it. A complete denial of access to conference content is high severity whether it arose from a deliberate refusal or from nobody reading the inbox.

Right of reply

Every advisory carries a reserved section for the organization's response. It is published verbatim and unedited, with its own timestamp, whether or not it disputes the record. There is no deadline on this and no condition attached to it. If an organization believes a record is wrong, the fastest correction available to them is to say so, and it will appear on the record itself.

Reporting to this registry

Reports are accepted from anyone who has been denied access and has already raised it with the organization concerned. Submissions are reviewed before publication; a submission is not an advisory, and nothing submitted appears publicly until it has been checked and accepted. See the report form.

Corrections

Send corrections to admin@barrieradvisories.org. Factual errors are fixed promptly, and the fix is recorded in the revision history of the record concerned rather than applied silently.