PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Taking The Guesswork Out of Vulnerability Reporting

hackerone.com | vulnerability | #github | #vulnerability-disclosure | #policy | #hackerone | #opensource | #security-md
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

GitHub and HackerOne add SECURITY.md files and security advisories so researchers can responsibly disclose open source vulnerabilities, with HackerOne's Policy Builder generating a policy in minutes.
Published
Collected

Related coverage

blog · hackerone.com
Report Smarter, Not Harder: HackerOne's Case for Better CIRCIA Rules
This coverage gives security teams current context for monitoring, validation, and remediation.
vulnerability · yeswehack.com
CVE-2023-54391 and beyond: excavating silent patches and the attacker-defender information gap
CVE-2023-54391: a Proxmox VE auth bypass fixed silently in 2023, exploited in 2026 before any advisory. The piece taxonomizes 'silent patch gaps' and why AI-assisted diffing makes them cheap to mine.
vulnerability · yeswehack.com
Coordinated Vulnerability Disclosure policy for a safer cyberspace
Argues coordinated vulnerability disclosure needs clear legal guidelines to thrive, noting fragmented EU interpretations of hacking and outlining how policy can make researcher reporting safer.
vulnerability · yeswehack.com
A framework for successful vulnerability disclosure policy
A YesWeHack framework for coordinated vulnerability disclosure tackling legal, awareness and communication barriers, with infographics to help organizations build a workable reporting process.
vulnerability · yeswehack.com
Incentive Policy for Coordinated Vulnerability Disclosure
An explainer contrasting Coordinated Vulnerability Disclosure with 'responsible disclosure', arguing CVD keeps vendors and researchers cooperating, and outlining what an incentive policy should cover.
Medium · vulnerability · github.com
CVE-2026-84636: Apple iOS/macOS SCDynamicStore Wi-Fi SSID Info Disclosure PoC
Wi-Fi SSID data is strictly guarded as sensitive location telemetry on iOS. This PoC shows that third-party applications could bypass sandbox entitlement checks via SCDynamicStore to silently track user network environments and physical locations.
Back