What is responsible disclosure?

How it works

A researcher finds a vulnerability and reports it through the channel the organisation publishes, usually a web form or a dedicated email address. The organisation acknowledges the report, confirms the issue, fixes it and tells the researcher when the fix is live. The details are then published, often with credit to the researcher and, for software products, a CVE identifier.

The timeline is the part most often argued about. Many researchers work to a fixed window, often 90 days, after which they publish whether or not a fix exists. An organisation can usually ask for more time when a fix is complex, but the request has to be reasonable and agreed with the researcher.

What a disclosure policy contains

A vulnerability disclosure policy tells researchers how to report and what they can expect in return. Publish it on your website, and point to it from a security.txt file at /.well-known/security.txt, the format set out in RFC 9116.

• Scope. Which systems and products are covered, and which are excluded, such as third-party services you do not control.
• Rules. What testing is allowed. Most policies forbid accessing other people’s data, denial-of-service tests and social engineering.
• Safe harbour. A statement that you will not take legal action over good-faith research that follows the rules.
• Response times. When the researcher will hear back, and how you will keep them informed until the fix.
• Rewards. Whether you pay bounties. A policy that offers no payment still gives researchers a safe route to report.

Where laws and frameworks expect it

ISO/IEC 27002, the guidance behind ISO 27001 control 8.8 on technical vulnerabilities, recommends a public point of contact for vulnerability reports. In the EU, NIS 2 Article 12 makes coordinated vulnerability disclosure part of each member state’s cyber security arrangements, with a national CSIRT acting as coordinator between researchers and vendors. The Cyber Resilience Act requires manufacturers of products with digital elements to have a coordinated vulnerability disclosure policy once its main obligations apply in December 2027. In the US, CISA Binding Operational Directive 20-01 requires federal civilian agencies to publish one.

Reports that arrive need an owner. Route them into the same queue as vulnerabilities you find yourself, with the same severity ratings and fix deadlines, so a researcher’s report does not sit unread in a shared inbox.

Related terms

Penetration test

An authorised, simulated attack on systems to find weaknesses an attacker could exploit. Most frameworks expect one at least once a year and after significant changes.

CAPA

Corrective and preventive action: the plan, owner and due date attached to an audit finding or incident, tracked until the fix is confirmed and the cause addressed.

Control

A specific safeguard or activity that reduces a risk, such as requiring MFA on privileged accounts or reviewing access every quarter. Frameworks are, in large part, lists of controls.