Coordinated Disclosure
A standard practice in vulnerability response in which the finder first privately notifies the maintainer and agrees on a public disclosure window (commonly 90 days) for remediation, balancing security disclosure with remediation time.
Core Facts
Timeline (last 90 days)
Coordinated Disclosure typically gives vendors or project maintainers about 90 days to develop and release patches.
When a project's security information relies on humans relaying it among multiple mailing lists, a single misaddressed recipient is enough to make coordinated disclosure fail.
The concept of Coordinated Disclosure emphasizes that vendors and researchers negotiate the disclosure timeline, rather than the researcher unilaterally setting a deadline.
Coordinated Disclosure is a convention between open-source projects and security researchers: researchers report vulnerabilities privately, vendors develop patches within an agreed timeframe, and both sides disclose details simultaneously to minimise user exposure time.
After AI discovers vulnerabilities at scale, the bottleneck of the human-paced coordinated disclosure process is exposed: disclosure windows are scheduled by project, while reports pour in all at once.
All Facts (5)
Coordinated Disclosure is a convention between open-source projects and security researchers: researchers report vulnerabilities privately, vendors develop patches within an agreed timeframe, and both sides disclose details simultaneously to minimise user exposure time.
70%UnverifiedCoordinated Disclosure typically gives vendors or project maintainers about 90 days to develop and release patches.
50%UnverifiedWhen a project's security information relies on humans relaying it among multiple mailing lists, a single misaddressed recipient is enough to make coordinated disclosure fail.
50%UnverifiedThe concept of Coordinated Disclosure emphasizes that vendors and researchers negotiate the disclosure timeline, rather than the researcher unilaterally setting a deadline.
50%UnverifiedAfter AI discovers vulnerabilities at scale, the bottleneck of the human-paced coordinated disclosure process is exposed: disclosure windows are scheduled by project, while reports pour in all at once.
50%