PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

An Attorney’s View of Vulnerability Disclosure

hackerone.com | vulnerability | #vdp | #vulnerability-disclosure | #policy | #hackerone | #cfaa | #legal
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Attorney Matthew J. Gardner explains how vulnerability disclosure programs resolve CFAA ambiguity around white-hat hacking by establishing consent—plus what to weigh when crafting a VDP.
Published
Collected

Related coverage

blog · hackerone.com
Report Smarter, Not Harder: HackerOne's Case for Better CIRCIA Rules
This coverage gives security teams current context for monitoring, validation, and remediation.
vulnerability · hackerone.com
Webinar Recap: Attorneys Chime in on Hacker-Powered Security
Webinar recap with Wiley Rein attorneys: CFAA penalties apply even to well-intentioned hackers, so disclosure programs and bounties increasingly define safe rules of engagement.
vulnerability · yeswehack.com
Coordinated Vulnerability Disclosure policy for a safer cyberspace
Argues coordinated vulnerability disclosure needs clear legal guidelines to thrive, noting fragmented EU interpretations of hacking and outlining how policy can make researcher reporting safer.
blog · hackerone.com
Critical PHP Vulnerabilities: What Security Teams Need to Know
Learn about the critical PHP vulnerabilities, HackerOne’s response, and the rise in reports. Review patching guidance and coordinated disclosure practices.
blog · hackenproof.com
Vulnerability Disclosure Policy: A Guide for Business Leaders
Explains what a vulnerability disclosure policy is and why the EU CRA and NIS2 now make it a compliance expectation, then walks through the key decisions behind each policy section, offering a free template for security and legal teams to adapt.
blog · tenzai.com
An open-weight model powered the #1 HackerOne VDP research operation
Tenzai's AI hacker topped the world's largest bug bounty leaderboard on GLM 5.2, a model anyone can download, and the offensive capability once limited to a few frontier labs is now within anyone's reach.
Back