Lesson 4.61: Coordinated vulnerability disclosure
Sooner or later an outsider finds a vulnerability in your systems. Whether they report it to you or sell it depends partly on how easy and safe you make reporting. Coordinated vulnerability disclosure (CVD) gives researchers a published contact (security.txt, RFC 9116), a policy with scope and safe harbour, and a process (ISO/IEC 29147 and 30111): acknowledge, triage, fix, and agree on publication. In the lab you find Northwind's security.txt expired, triage a real-looking report of customer data exposure, replace the file, and send the acknowledgement.
15 min
You will learn to
- Explain coordinated vulnerability disclosure
- Read and fix a security.txt (RFC 9116)
- Triage a report against a disclosure policy
- Explain safe harbour
- Acknowledge a reporter properly
Key terms
- Coordinated vulnerability disclosure (CVD)
- Reporter and vendor agree on fixing before details are published.
- security.txt
- A file at /.well-known/security.txt telling researchers how to report (RFC 9116).
- Safe harbour
- A promise not to take legal action against good-faith research within the policy.
- Bug bounty
- A programme that pays rewards for valid reports, often run through a platform.
- BOLA / IDOR
- Broken object level authorisation: the API returns objects without checking ownership.
← Authentication, authorisation, accounting and MFA · All lessons · Insider risk: lawful and proportionate →