What is responsible disclosure and how does it work?

Responsible disclosure means a finder reports a security flaw privately to the party that can fix it, gives that party time to respond, and publishes details only after a fix or an agreed deadline. Today most standards bodies call this coordinated vulnerability disclosure, because coordination, not just good manners, is the point.

Is responsible disclosure the same as coordinated disclosure?

Nearly. The CERT Coordination Center defines coordinated vulnerability disclosure (CVD) as gathering information from finders, coordinating the sharing of that information between the relevant stakeholders, and disclosing the existence of the vulnerability and its mitigations to those stakeholders, including the public. The older phrase "responsible disclosure" put the burden on the finder. CVD treats it as a shared process between finder, vendor, and sometimes a coordinator.

CERT/CC has coordinated disclosures since 1988, which is a useful reminder that none of this is new. What changed is that open source, medical devices, industrial systems and AI products all now sit in the same pipeline.

What does the process look like step by step?

CISA publishes its own workflow, and it is a good model. A researcher submits a report. The team triages it: does it look legitimate, is it actionable, is it in scope, is it already known to the vendor or already public. If accepted, the team identifies the supplier, confirms the technical details, tracks the timeline and mediates between reporter and vendor when needed.

Next comes a decision on whether the flaw warrants a CVE record and which CVE Numbering Authority publishes it. Then an advisory is drafted, a publication date is agreed, and the details go public together with mitigations. CISA also evaluates whether the flaw belongs in its Known Exploited Vulnerabilities catalog.

How long does the vendor get?

There is no single global deadline. CISA states that the timeline depends on whether the flaw is already public or actively exploited, the potential impact, vendor responsiveness and whether mitigations exist. If a vendor is unresponsive or will not commit to a reasonable remediation timeframe, CISA says it may disclose as early as 45 days after the first attempt to contact the vendor, even without a patch.

Treat that as one agency's published policy, not a universal rule. Other coordinators and researchers set their own windows, so say yours out loud in your policy.

What is the difference between CVD and a VDP?

CISA draws a clear line. CVD coordinates a flaw in someone else's product between a researcher and a supplier, including CVE assignment and advisory publication. A vulnerability disclosure policy (VDP) is the front door for flaws in your own public systems: how you receive reports, what is in scope, and what a reporter can expect. A VDP does not itself involve coordination, remediation or advisories.

If you ship software, you probably need both: a VDP for your own services and a CVD capability for flaws in what you build and sell.

How do you make yourself reportable?

Publish a security.txt file. RFC 9116 defines it as a text file served at /.well-known/security.txt. OWASP's disclosure guidance says to include at minimum the Contact and Expires fields, and optional fields such as Policy, Canonical, Encryption and Preferred-Languages help route reports.

A constructed example: a small SaaS vendor adds a Contact line pointing to a monitored security mailbox, an Expires date six months out, and a Policy link to a one page statement of scope and response targets. A researcher who finds a flaw on a Friday now knows where to send it and what to expect on Monday.

How to check or apply this

1. Create a monitored security mailbox or intake form and name an owner.
2. Publish security.txt at /.well-known/security.txt with Contact and Expires, and put a calendar reminder before the expiry date.
3. Write a short policy: what is in scope, how fast you acknowledge reports, and how you treat good faith research.
4. Decide your own disclosure window and state it, including what happens if a fix takes longer.
5. Triage every report with the same questions CISA uses: legitimate, actionable, in scope, already known.
6. When a fix ships, publish an advisory and request a CVE through the appropriate CNA.

Quick check

Sources

1. CISA, The Coordinated Vulnerability Disclosure (CVD) Program
2. CERT/CC, The CERT Guide to Coordinated Vulnerability Disclosure
3. RFC 9116, A File Format to Aid in Security Vulnerability Disclosure
4. OWASP, Vulnerability Disclosure Cheat Sheet

Last reviewed: 18 October 2026.