What is Responsible Disclosure?
Also called Coordinated Vulnerability Disclosure.
Responsible disclosure is the practice by which a person who discovers a security vulnerability reports it privately to the affected organization and allows time for a fix before publishing details. Also called coordinated vulnerability disclosure, it depends on a published reporting channel, a stated timeline, and assurance that good faith researchers will not face legal action.
A workable program has four visible parts: a documented way to report, a defined scope stating which systems and testing methods are in bounds, a commitment to acknowledge and update the reporter, and a safe harbor statement that the organization will not pursue researchers who stay within the stated rules. Missing any of these tends to push finders toward public posting instead.
Timelines are conventional rather than legally fixed. A period on the order of ninety days before publication is a common norm, with shorter windows where a vulnerability is already being exploited and extensions where a fix is genuinely complex. Disputes usually arise when an organization treats the deadline as negotiable indefinitely, which is the situation the norm exists to prevent.
International standards describe the process from both sides, covering how to receive reports and how to handle vulnerabilities internally. Related infrastructure includes identifier assignment for tracked issues and advisory publication, which lets downstream users of a component learn that they are affected. Organizations shipping software to others generally need a disclosure path of their own for exactly this reason.
AI systems raise scope questions that traditional programs did not anticipate. Model behavior findings such as jailbreak techniques, unsafe tool invocation and prompt injection paths sit between security vulnerability and safety issue. Programs increasingly state explicitly whether model behavior is in scope, how such reports are triaged, and what testing is permitted against production endpoints.
Key points
- Private report first, publication after a fix window
- Needs a channel, a scope, updates and a safe harbor statement
- Roughly ninety days is a common norm, not a legal rule
- International standards cover receiving and handling reports
- State explicitly whether model behavior findings are in scope
In practice
A researcher finds that a document sharing endpoint returns records belonging to other accounts under a specific parameter. They report through the published security address rather than posting the finding. The vendor acknowledges within a day, reproduces the issue, ships a fix, checks access logs for prior exploitation, and publishes an advisory crediting the researcher once affected customers have been notified.