Vulnerability Disclosure

🔑 Key Takeaway: Vulnerability disclosure makes fixed issues public on a deliberate timeline. Before that, teams need inbound reporting paths, triage, and a plan when quiet disclosure is no longer safe.

Vulnerability disclosure is the work of informing the wider community after a vulnerability has been identified and addressed (or when public awareness is otherwise required). Disclosure often follows a bug bounty report that has been triaged and fixed, or an internal finding that has been remediated.

When responsible coordinated disclosure is not possible because vulnerable code is already under active exploit or imminently will be, Safe Harbor may be the applicable path.

Basics

Effective disclosure programs share three layers:

• Inbound reporting: researchers and users must know how to reach the right people (see Security Contact).
• Triage and fix: skilled intake, severity assessment, and remediation before any public write-up.
• Outbound disclosure: clear public communication after the fix (or under Safe Harbor when quiet coordination fails).

Bug bounty platforms and self-run programs change how reports arrive and how rewards work; they do not replace security contacts, triage ownership, or disclosure discipline.

What this framework covers

1. Security Contact: SECURITY.md, dedicated security mailboxes, and .well-known/security.txt so researchers can report issues reliably.
2. Bug Bounties: platform choices, self-run tradeoffs, and program elements (scope, rewards, triage, safe harbor language, disclosure policy).

Related frameworks

• Safe Harbor: coordination when active or imminent exploitation changes the disclosure path
• External Security Reviews: paid audits complementary to continuous bounty intake
• Incident Management: response when a reported issue is actively exploited
• Secure Software Development: fixing and preventing classes of defects
• Security Testing: proactive testing alongside external researchers

Further reading

• ISO/IEC 29147 Vulnerability disclosure (overview of the standard family)
• FIRST product security incident response services framework
• security.txt: machine-readable security contact discovery
• GitHub documenting a security policy