Responsible Vulnerability Disclosure

Also Known As

TL;DR

Explanation

Responsible (coordinated) vulnerability disclosure balances the public's right to know about vulnerabilities with the vendor's need for time to fix them. A researcher discovers a vulnerability, privately reports it to the vendor with a technical description, agrees on a disclosure timeline (typically 90 days, e.g., Google Project Zero's policy), and publishes a CVE after the fix is released. For PHP projects, provide a SECURITY.md file with a private reporting channel (security@domain.com), acknowledge reports within 48 hours, and maintain a CVE assignment process.

Common Misconception

Why It Matters

Common Mistakes

• No security.txt or disclosure email — researchers cannot find a contact and publish instead.
• Legal threats to researchers reporting in good faith — destroys trust and deters future reports.
• No acknowledgement within 24-48 hours — researchers assume the report was missed.
• No timeline commitment — researchers cannot plan responsible disclosure without a fix timeline.

Code Examples

# Missing security.txt — no disclosure channel:
# GET /.well-known/security.txt → 404
# Researcher finds SQL injection, has nowhere to report
# Options: disclose publicly, sell to broker, or give up
# All worse than a working disclosure channel

# Correct /security.txt:
# Contact: security@example.com
# Expires: 2027-01-01T00:00:00z
# Preferred-Languages: en

# Responsible Disclosure — security.txt (RFC 9116)
# Place at https://yourapp.com/.well-known/security.txt

Contact:   security@yourapp.com
Expires:   2025-12-31T00:00:00.000Z
Encryption: https://yourapp.com/pgp-key.txt
Preferred-Languages: en
Policy:    https://yourapp.com/security-policy

# Response process:
# 1. Acknowledge receipt within 48 hours
# 2. Confirm vulnerability within 5 business days
# 3. Target fix: critical = 7 days, high = 30 days, medium = 90 days
# 4. Coordinate disclosure date with reporter
# 5. Credit reporter in changelog/CVE (if they want)
# 6. Publish CVE if CVSS >= 4.0

# Do NOT: ignore reports, threaten legal action against good-faith researchers

References

• ↗ https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability_Disclosure_Cheat_Sheet.html
• ↗ https://www.first.org/cvss/

Tags

Related Terms