Coordinated Disclosure

# Coordinated disclosure - both sides

> Coordinated vulnerability disclosure (CVD) is the practice of reporting
> security flaws to vendors in a way that protects users while giving
> vendors time to fix.

## Reporter responsibilities

- Find the vendor's disclosure channel (security.txt, security@, VDP)
- Provide a clear, reproducible report
- Suggest a reasonable disclosure deadline (often 90 days)
- Do not test beyond what is needed to confirm the issue
- Do not exfiltrate or alter customer data
- Respect any third-party data you encounter; report and stop

## Vendor responsibilities

- Publish a security.txt (RFC 9116) with contact + PGP + policy + hiring
- Acknowledge reports promptly (24-72 hrs)
- Provide a clear timeline + named contact
- Coordinate CVE assignment via MITRE / their CNA
- Credit the reporter unless they ask otherwise
- Release advisories alongside fixes

## A working timeline (illustrative)

- Day 0 - report received
- Day 1-3 - acknowledged + triaged
- Day 4-30 - reproduction + fix scoped
- Day 30-75 - fix developed, tested, staged
- Day 75-90 - coordinated release; advisory published
- Day 90+ - reporter may publish their write-up

## Tools + standards

- security.txt: https://securitytxt.org
- CVD policy templates from CERT/CC, FIRST
- CNA programme for in-house CVE issuance
- ISO/IEC 29147 + 30111 for vendor receiving processes

## Common failure modes

- Vendor uses legal threats to silence reporters (incredibly damaging)
- Reporter publishes without coordination (often illegal, always reckless)
- Slow vendor; no progress updates; researcher publishes early
- Patches without advisories (users do not know to update)

## If a vendor is unresponsive

- Use CERT/CC or your national CSIRT as an intermediary
- Set a public disclosure date in writing and stick to it
- Document all communications
- Keep customer safety as the priority

## For defenders running the receiving side

- Publish security.txt today
- Tabletop a hypothetical critical disclosure annually
- Use a tracker (Jira, GitHub Security Advisories) - not shared inboxes
- Train PR + legal so the response is professional, not defensive

# Coordinated disclosure:
#   - Contact security@ or via security.txt.
#   - Give a reasonable patch window (90 days is industry norm).
#   - Publish only after coordinated release (or on no-response timer).
# Never extort. Never publish working exploits before a fix is widely deployed.