PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Vulnerability Disclosure Policy

projectblack.io | vulnerability | #vulnerability-disclosure | #policy | #coordinated-disclosure | #cna | #project-black
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Project Black's disclosure policy: vendors get up to 14 days of contact attempts and 90 days to remediate, with earlier public disclosure if a fix ships or active exploitation is observed.
Published
Collected

Related coverage

research · projectblack.io
Project Black is now a CVE Numbering Authority (CNA)
Project Black has been authorised as a CVE Numbering Authority, letting it assign CVE IDs and publish CVE Records directly to reduce disclosure delays for vulnerabilities its researchers find.
blog · depthfirst.com
Our Approach to Coordinated Vulnerability Disclosure
depthfirst's coordinated disclosure policy: every report is human-verified and includes a PoC and fix guidance; vendors get 30 days to patch, then a 7-day adoption window before publication.
blog · hackerone.com
Report Smarter, Not Harder: HackerOne's Case for Better CIRCIA Rules
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · wiz.io
Increasing transparency in cloud security: Wiz is now a CVE Numbering Authority (CNA)
Wiz became a CVE Numbering Authority able to assign CVE IDs and disclose cloud vulnerabilities—the latest step after helping build the community cloud vulnerability database.
vulnerability · yeswehack.com
CVE-2023-54391 and beyond: excavating silent patches and the attacker-defender information gap
CVE-2023-54391: a Proxmox VE auth bypass fixed silently in 2023, exploited in 2026 before any advisory. The piece taxonomizes 'silent patch gaps' and why AI-assisted diffing makes them cheap to mine.
vulnerability · hackerone.com
What Is a Vulnerability Disclosure Program and Do You Need One?
HackerOne explains why every organization needs a Vulnerability Disclosure Program (VDP): safe harbor for finders, avoiding public disclosure, and meeting compliance mandates.
Back