Responsible disclosure

Responsible disclosure, now more commonly called coordinated vulnerability disclosure (CVD), is the practice of reporting a vulnerability privately to the organisation that owns the affected system and giving it time to fix the problem before any details are made public.

What it means

The terms are set out in a disclosure policy: a public page stating what may and may not be tested, how to submit a report, how quickly the organisation will respond and when publication follows. The customary window is 90 days, a norm popularised largely by Google Project Zero. That team gives a vendor 90 days to make a patch available and publishes the details 30 days after the patch reaches users. If no patch arrives, the write-up goes out at the 90 day mark anyway. A vendor whose fix is nearly ready can ask for a 14 day grace period.

Two building blocks make such a policy work in practice. The first is a security.txt file served from /.well-known/security.txt and described in RFC 9116. Only two fields are mandatory, a contact address and an expiry date, but a link to the policy, the languages you accept reports in and a pointer to your encryption key save a great deal of back and forth. Without the file, a finder hunts around the website and the report ends up in a general support queue. The second block is safe harbour wording: an explicit promise that the organisation will not file a criminal complaint or pursue civil claims against a researcher who stays inside the published rules. The CERT Guide to Coordinated Vulnerability Disclosure is the standard reference for putting the whole process together.

Why it matters

Responsible disclosure is not the same thing as a bug bounty. A bug bounty is a paid programme with a reward table per finding and usually a platform behind it. Responsible disclosure is the underlying reporting process, where the return is an acknowledgement, a hall of fame listing or at most some swag. Every bug bounty programme rests on a disclosure policy, but most disclosure policies pay nothing at all.

For the receiving organisation, the payoff is time. A finder who knows where to send a report and where they stand legally comes to you first, rather than to a journalist or a buyer on an underground forum. That difference decides whether you patch a vulnerability calmly or read about it in the news.