Also known as: coordinated disclosure · CVD · vulnerability disclosure
Responsible disclosure, also called coordinated vulnerability disclosure, is the practice of privately reporting a vulnerability to the affected vendor and allowing a defined period for a fix before publishing details.
The model balances two competing harms: publishing immediately arms attackers against undefended users, while indefinite secrecy leaves users unaware of risk and removes vendor pressure to fix. A disclosure deadline, commonly 90 days, imposes that pressure.
Friction persists because incentives differ. Researchers want fixes shipped and credit given; vendors want time and control over messaging. Full disclosure — publishing without notice — remains a minority practice, usually a response to vendors who ignore or threaten reporters.
Zero-Day
A zero-day is a software vulnerability that attackers know about and exploit before the vendor has released a patch, leaving defenders zero days to prepare a fix.
Bug Bounty
A bug bounty is a programme in which an organisation offers monetary rewards to external security researchers who responsibly report vulnerabilities in its systems.
CVE
CVE (Common Vulnerabilities and Exposures) is a public catalogue that assigns a unique identifier, such as CVE-2026-31337, to each publicly disclosed software vulnerability so that everyone can refer to the same flaw unambiguously.
Exploit
An exploit is code or a technique that takes advantage of a specific vulnerability to cause unintended behaviour, such as executing attacker-supplied code, bypassing authentication, or crashing a service.