Home / Knowledge hub / Vulnerability coordination
Knowledge hub
Vulnerability coordination
The process of reporting a flaw to a vendor and agreeing when to publish.
What it means
Vulnerability coordination, also called coordinated disclosure, is the process of passing details of a flaw from the finder to the people who can fix it, and agreeing when the details become public. It often involves the finder, the vendor, and sometimes a coordinator such as a national response team.
The aim is a fix that exists before details are published. The finder reports in private, the vendor confirms and works on a patch, and both agree a date. ISO/IEC 29147 describes how vendors receive reports, and ISO/IEC 30111 describes how they handle them.
Why it matters
If a researcher finds a flaw in your product and has nowhere to send it, they may publish it, sell it or give up. A clear route and a prompt reply keep the report private long enough for you to fix it. A good response is also noticed by customers and by those who write about security. Fair, prompt handling of a report is also a sign to customers that you take security seriously.
It matters in the other direction too. If you find a flaw in a supplier's software, coordination gives them a fair chance to respond. It is closely linked to vulnerability disclosure and often runs through a bug bounty programme. Fair handling of a report also tells customers you take security seriously.
How it shows up
Publish a contact route, usually a security page and an address, and a security.txt file as described in RFC 9116. Acknowledge reports quickly, ask for reproduction steps, and give the finder a date. Typical windows run from about 45 days at CERT/CC to 90 days for Google Project Zero, with extensions if a fix is close.
Teams stumble by having no named owner, replying late or defensively, or threatening the finder. Treat a good-faith report as a gift. Keep a log of dates, fix the flaw, confirm the fix, and tell the finder when it is live. Credit them if they want it.
Questions people ask
Vulnerability coordination, answered
What is the difference between coordinated and full disclosure?
In coordinated disclosure the finder reports privately and waits for a fix before publishing. In full disclosure details are published immediately, with no warning.
Most organisations prefer coordination because customers are protected sooner.
How long is the usual disclosure window?
Common defaults are 45 days at CERT/CC and 90 days at Google Project Zero. Many vendors ask for similar periods.
Windows are often extended when a fix is nearly ready, or shortened if exploitation is already under way.
What is a security.txt file?
It is a small text file at a known location on your site that tells researchers how to report a flaw. RFC 9116 defines the format.
It reduces the chance that a report goes nowhere.
Do we need a bug bounty to take reports?
No. A clear contact route and a promise to respond are enough to start. A bounty adds rewards and attracts more reports.
Start with the route and add the programme later if you want one.
Who is a coordinator?
A neutral party who helps when the vendor and finder cannot reach each other, or when many vendors are affected. CERT/CC is an example.
They pass the report on and help set the timeline.
Related
Terms that sit next to this one
Vulnerability disclosure
Telling an organisation about a flaw, and the policy that makes it safe.
Bug bounty
Paying outside researchers for vulnerabilities they report responsibly.
Security incident
An event that actually harms, or threatens to harm, your data or systems.
CVE
A public reference number for one known flaw in one piece of software.
Incident response plan
A written plan for who does what in the first hours after a security incident.
Who receives the report?
Reports are easier to act on when they show how the flaw was used. Our findings carry the request, the response and the line of code. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.