Disclosure is surrounded by folklore, and six myths in particular cause bad decisions on both sides of the table. Each one is checked here against published guidance from OWASP, CISA, Project Zero and others. Where a point depends on law or your own agreements, check with counsel.
Myth 1: A bounty is how you start
Fact: OWASP advises considering a bounty only once you have a mature disclosure process and internal fixing processes. Start with a policy and a contact. See readiness checklist.
Myth 2: Researchers who write to you are threats
Fact: Most are not, and OWASP advises organizations against threatening legal action. It also advises researchers not to demand payment before revealing details. Good behavior is expected from both sides.
Myth 3: There is one standard deadline
Fact: Timelines differ. Project Zero uses 90 days plus 30 after a patch, and 7 days for in-the-wild exploitation. CISA says timing depends on factors including exploitation and vendor responsiveness, and that it may disclose as early as 45 days after first contact if a vendor does not respond. Agree dates per case. See disclosure deadlines.
Myth 4: Without a bounty, nobody will report
Fact: Researchers report for many reasons, including credit and wanting something fixed. OWASP lists non-monetary rewards such as swag, discounts and a hall of fame. See thanking researchers.
Myth 5: security.txt is optional decoration
Fact: It is optional, but RFC 9116 makes Contact and Expires required when you publish one, and OWASP lists it as an intake channel. A stale file past Expires should not be used. See keeping it fresh.
Myth 6: Safe harbor makes testing legal
Fact: disclose.io describes safe harbor as policy language that lets good-faith reporters act without fear of legal repercussions, and says its content is not legal advice. It covers what you, the organization, promise. It cannot bind third parties. See what safe harbor means.
Putting it to use. If you are a company, publish a policy, a contact, safe harbor and response times. If you are a researcher, stay in scope, protect privacy and write clearly. Both sides gain from predictable behavior.
Quick check
Which myth costs companies the most?
Believing a reward program can stand in for a response process. Researchers care first about whether anyone answers.
Where should a newcomer start reading?
The OWASP cheat sheet, then the coordinated disclosure guide.
Sources
- OWASP: Vulnerability Disclosure Cheat Sheet
- CISA: Coordinated Vulnerability Disclosure process
- Project Zero: Vulnerability Disclosure Policy
- IETF: RFC 9116, security.txt
- disclose.io: overview
Last reviewed: 19 October 2026.
