PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Mobilising collective intelligence for better security

yeswehack.com | vulnerability | #bug-bounty | #vulnerability-disclosure | #cvd | #security-txt | #cert | #coordination | #zerodisclo
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

How to enable 'first contact' in coordinated vulnerability disclosure — via CERTs, security.txt, ZeroDisclo.com and bug bounty — so researchers report bugs instead of going public.
Published
Collected

Related coverage

vulnerability · yeswehack.com
ZeroDisclo.com: Vulnerability disclosure done right
ZeroDisclo.com, a non-profit platform relaying encrypted, anonymous vulnerability reports to CERTs, redesigned its site with clearer submission forms, an FAQ and a concise disclosure policy.
vulnerability · hackerone.com
Your TL;DR Summary of The CERT Guide to Coordinated Vulnerability Disclosure
A TL;DR of Carnegie Mellon's 121-page CERT Guide to Coordinated Vulnerability Disclosure—covering why CVD matters, who to involve, and how to handle process bumps, with key excerpts.
vulnerability · yeswehack.com
CVE-2023-54391 and beyond: excavating silent patches and the attacker-defender information gap
CVE-2023-54391: a Proxmox VE auth bypass fixed silently in 2023, exploited in 2026 before any advisory. The piece taxonomizes 'silent patch gaps' and why AI-assisted diffing makes them cheap to mine.
vulnerability · yeswehack.com
Coordinated Vulnerability Disclosure policy for a safer cyberspace
Argues coordinated vulnerability disclosure needs clear legal guidelines to thrive, noting fragmented EU interpretations of hacking and outlining how policy can make researcher reporting safer.
vulnerability · yeswehack.com
A framework for successful vulnerability disclosure policy
A YesWeHack framework for coordinated vulnerability disclosure tackling legal, awareness and communication barriers, with infographics to help organizations build a workable reporting process.
vulnerability · yeswehack.com
Roles and responsibilities for efficient vulnerability disclosure
YesWeHack breaks down the roles and responsibilities — system managers, publishers, researchers — needed for coordinated vulnerability disclosure, with an infographic in English and French.
Back