Disclosure
Safeguard articles tagged "Disclosure" — guides, analysis, and best practices for software supply chain and application security.
9 articles
How to Report a Security Vulnerability
You found a security bug — now what? This beginner guide walks through reporting a vulnerability responsibly, from finding the right contact to writing a clear report.
SEC cyber-incident 8-K disclosure and the software supply chain in 2026
The SEC's Item 1.05 8-K rule has been live since December 2023, and supply-chain incidents are now the most common trigger for a four-day materiality clock. Here is what programs need to know.
Two Years of Item 1.05: What the Notable 8-K Filings Tell Us
From UnitedHealth to AT&T to Snowflake's downstream effects, two years of Item 1.05 filings reveal patterns in materiality, vendor incidents, and update cadence.
SEC Form 8-K Item 1.05: Two Years of Enforcement Lessons
Two years into mandatory cybersecurity incident disclosure, the SEC has issued comment letter sweeps and settled enforcement actions. Here is what filers got wrong.
Coordinated Disclosure Zero-Day Playbook
A playbook for coordinated disclosure of zero-day vulnerabilities, covering timelines, stakeholder management, embargo discipline, and the judgement calls in between.
Supply Chain Incident Notification Laws: A Global Overview
Governments worldwide are mandating supply chain incident disclosure. Here is what organizations need to know about notification requirements across major jurisdictions.
How to Write a Security Advisory That Actually Helps
Most security advisories are either too vague to be actionable or too detailed to be safe. Here is how to write advisories that help defenders without enabling attackers.
Security Incident Communication Guide
How to communicate during and after a security incident without making things worse. Templates, timelines, and principles for crisis communication.
Vulnerability Coordination Across the Open Source Ecosystem
When a vulnerability affects a library used by thousands of projects, coordinating the fix is harder than writing the patch. The coordination problem is open source security's biggest operational challenge.