Add an entry to the credits array of the CVE record with the person's name and a type. The schema offers ten types, and finder is the default. Pick finder for who discovered the flaw, reporter for who told you, and other types for fix work, testing and sponsorship, so each contribution is named accurately.
The ten types
The CVE Record Format defines these values for the credit type:
| Type | Use it for |
|---|---|
| finder | The person who discovered the issue (default) |
| reporter | The person who notified you, if different from the finder |
| analyst | Someone who analyzed the issue |
| coordinator | A person or team who coordinated the disclosure |
| remediation developer | Who wrote the fix |
| remediation reviewer | Who reviewed the fix |
| remediation verifier | Who verified the fix works |
| tool | A tool that found the issue |
| sponsor | A sponsor of the research |
| other | Anything that fits none of the above |
Each entry needs a language code and a value, and may carry a user identifier and the type. The wording is yours, so use the name the person asked for.
Choosing between finder and reporter
Often the same person does both, and one entry is enough. Use two when a team lead reports on behalf of a researcher who found the bug. The finder is the one who deserves the headline thanks.
Crediting fix work
Many advisories forget the people who fixed the bug. If an outside contributor sent the patch, add a remediation developer entry. If a researcher retested your fix and confirmed it, add remediation verifier. These small lines motivate repeat contributors.
When a tool found it
The tool type exists for automated discovery. If an AI system or fuzzer found the flaw, say so honestly and name the human who validated and reported it. Our post on AI-found vulnerabilities and credit goes through the cases.
Rules of good manners
- Ask how they want to be named, or whether they want no credit.
- Use the same spelling in the advisory, the changelog and the record.
- Do not add credit for someone who broke your rules, such as testing outside scope.
- Publish credits on the same day as the advisory, not later.
For wider recognition practices, see how to thank and credit researchers.
Quick check
What is the default credit type?
Finder, according to the schema.
Can I credit the person who wrote the fix?
Yes. Use remediation developer, and add reviewer or verifier entries for the people who checked it.
Safeguard's zero-day discovery and policies can feed your own advisory process, and a free scan shows how your dependencies are covered.
Sources
Last reviewed: 19 October 2026.
