Lesson 5.6: Responsible disclosure, bug bounties and security.txt
You found a vulnerability. Coordinated (responsible) disclosure, full disclosure and bug bounty programmes; how much proof is enough; the usual 90-day deadline; CVE identifiers; and security.txt (RFC 9116), the standard file that tells you whom to contact. In the lab you read a company's security.txt, redact personal data from your report before sending it, and publish a security.txt for your own company.
17 min
You will learn to
- Explain coordinated disclosure, full disclosure and bug bounties
- Know where to stop when proving a vulnerability
- Read and write a security.txt file
- Redact personal data from a vulnerability report
- Explain CVE identifiers and disclosure deadlines
Key terms
- Vulnerability disclosure
- Telling the right people about a security hole.
- Coordinated disclosure
- Reporting privately to the owner, giving them time to fix it, and publishing details only after a fix or an agreed deadline.
- Full disclosure
- Publishing all details at once, without waiting for a fix.
- Bug bounty
- A programme in which a company invites testing within published rules and scope, and pays for valid findings.
- Safe harbour
- A company's written promise not to take legal action against researchers who follow its rules in good faith.
- security.txt
- A text file at /.well-known/security.txt that tells researchers how to report vulnerabilities to a website's owner.
- CVE
- A public identifier for a known vulnerability, like CVE-2014-0160 (Heartbleed).
← Changing users: su and sudo · All lessons · Changing passwords →