What Is Responsible Disclosure?
Responsible disclosure — increasingly called coordinated vulnerability disclosure — is the ethical process of reporting a security flaw privately to whoever can fix it, then giving them reasonable time to do so before the details go public. It is the social contract that lets researchers and vendors work together instead of against each other.
How does the process work?#
A typical coordinated disclosure runs:
- Discover — a researcher finds a vulnerability.
- Report privately — through a security contact, a
security.txtfile, or a vulnerability disclosure program. - Acknowledge & triage — the vendor confirms and validates.
- Fix — a patch is developed, often within an agreed window (commonly 90 days).
- Publish — details are released once a fix ships or the deadline passes, usually with a CVE and credit to the reporter.
The deadline matters: it protects the public’s right to know while giving the vendor a fair chance, and it stops disclosure being held hostage indefinitely.
Why not just publish immediately?#
Because timing changes who benefits. Compare the models:
| Model | Vendor gets warning | Users at risk during fix |
|---|---|---|
| Full disclosure | No | Higher — details are public before a patch |
| Responsible / coordinated | Yes | Lower — patch precedes public detail |
| Non-disclosure (sitting on it) | N/A | Ongoing — the flaw stays silently exploitable |
Responsible disclosure is the ethical backbone of bug bounties and the whole CVE ecosystem. More at the Security Fundamentals hub.
Frequently asked questions#
What is coordinated vulnerability disclosure?
Coordinated (or responsible) disclosure is when a researcher reports a vulnerability privately to the vendor, agrees on a timeline to fix it, and only publishes details after a patch is available or the deadline passes. It balances the vendor’s need to fix with the public’s right to eventually know.
What is the difference between responsible and full disclosure?
Responsible disclosure gives the vendor private notice and time to patch before going public. Full disclosure publishes details immediately and openly, arguing it pressures vendors and warns users faster. Most modern practice favors coordinated disclosure with a defined deadline as a middle path.