What is responsible disclosure?
Responsible disclosure is a way of handling a newly found vulnerability so that users are protected before attackers learn about it. The finder, often an independent researcher, reports the flaw privately to the organization that can fix it. The organization confirms it, builds and ships a fix, and then the details are published, usually with credit to the researcher. Many organizations now call the practice coordinated vulnerability disclosure (CVD), a name that stresses that the finder, the vendor and sometimes a coordinator such as CERT/CC agree on the timing together. Two international standards describe the vendor's side: ISO/IEC 29147 for receiving reports and publishing advisories, and ISO/IEC 30111 for the internal handling process.
How a coordinated disclosure unfolds
| Day | Step |
|---|---|
| 0 | A researcher finds an authentication bypass in a VPN appliance and emails the contact listed in the vendor's security.txt file, with proof-of-concept steps. |
| 2 | The vendor's product security team acknowledges the report and assigns a case number. |
| 9 | The vendor reproduces the flaw, scores it with CVSS and reserves a CVE ID. |
| 48 | Fixed firmware ships to customers. |
| 62 | The vendor publishes an advisory with the CVE, and the researcher publishes a write-up, as agreed. |
Researchers usually set a deadline so a report cannot sit forever. Google Project Zero's 90-day policy and CERT/CC's 45-day default are well-known examples, and extensions are common when a fix is genuinely hard. When a flaw is already being exploited, timelines shrink, because defenders need the details to protect themselves.
Publishing a disclosure policy
An organization makes responsible disclosure practical by publishing a vulnerability disclosure policy (VDP). The policy lists the systems researchers may examine and the techniques that are off limits, with denial of service, social engineering and viewing other people's data as typical exclusions. It explains where to send findings and when to expect a reply, and it carries a safe harbor promise that good-faith researchers who follow the rules will not face legal action. A security.txt file served at /.well-known/security.txt, defined in RFC 9116, tells researchers where to send reports; its Contact and Expires fields are mandatory. CISA's Binding Operational Directive 20-01, issued in 2020, made a published VDP mandatory for U.S. federal civilian executive branch agencies.
Responsible disclosure vs. full disclosure vs. bug bounty
- Responsible or coordinated disclosure: private report first, public details after a fix or an agreed deadline.
- Full disclosure: details published at once, before any fix, to pressure the vendor or warn users. Attackers get the same head start.
- Bug bounty program: a disclosure program that also pays rewards for valid findings, under a defined scope and payout scale.
- Penetration test: a contracted team testing under rules of engagement for a fixed period, not an open invitation to outsiders.
The same etiquette applies in reverse. A flaw your own team finds in a supplier's product goes to that supplier's security contact, not to social media.
Responsible disclosure on the CompTIA Security+ exam
Responsible disclosure falls under SY0-801 objective 4.3, where external reporting gives outsiders a safe way to tell an organization about flaws its own scans and tests missed. Wording such as "publish instructions for outside researchers to report vulnerabilities," "the researcher notified the vendor privately and waited for a patch" or "a safe way to report flaws without paying for them" points to responsible disclosure or a disclosure policy. Distractors are a bug bounty program, which adds payment; a penetration test, which is contracted and time-boxed; and full disclosure, which publishes before a fix exists.