Responsible disclosure

How it is used

Today often called coordinated vulnerability disclosure (CVD). Researchers and vendors agree a deadline, often around 90 days. Companies publish a disclosure policy or a security.txt file that explains how to report issues.

Example sentences

1. Thanks to responsible disclosure, the patch was ready before the details went public.

2. Our responsible disclosure policy is linked from the website footer.

Common collocations

• coordinated vulnerability disclosure
• disclosure policy
• disclosure deadline
• full disclosure
• security.txt

Related terms

• bug bountyA programme in which an organisation invites outside researchers to find and report vulnerabilities in its systems and pays rewards for valid reports.
• vulnerabilityA weakness in software, hardware, a configuration or a process that an attacker could use to cause harm or to gain access they should not have.
• zero-dayA vulnerability that is unknown to the vendor or has no patch yet, so defenders have had 'zero days' to fix it when it is first exploited.
• ethical hackerA security professional who uses attackers' skills and methods, with the owner's written permission, to find and report weaknesses so that they can be fixed.
• CVECommon Vulnerabilities and Exposures: a public catalogue that gives each publicly known vulnerability a unique ID, such as CVE-2021-44228.

This word in other fields

The same English word can have a different meaning in another field:

• responsible disclosure · Software Engineering

More terms: Vulnerabilities and Patching

• patch
• vulnerability scan
• remediation
• mitigate
• patch management
• CVSS
• misconfiguration
• hardening