PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Our Approach to Coordinated Vulnerability Disclosure

depthfirst.com | blog | #supply-chain | #vulnerability-research | #vulnerability-disclosure | #responsible-disclosure | #coordinated-disclosure | #security-policy | #open-source-security
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

depthfirst's coordinated disclosure policy: every report is human-verified and includes a PoC and fix guidance; vendors get 30 days to patch, then a 7-day adoption window before publication.
Published
Collected

Related coverage

blog · bishopfox.com
A Need for Vigilance in Open Source Software: Dolibarr CRM Advisory Release
Bishop Fox explains why open source software demands vigilance, detailing three vulnerabilities found in Dolibarr CRM 9.0.1: two remote code executions and a stored XSS.
blog · hackenproof.com
Vulnerability Disclosure Policy: A Guide for Business Leaders
Explains what a vulnerability disclosure policy is and why the EU CRA and NIS2 now make it a compliance expectation, then walks through the key decisions behind each policy section, offering a free template for security and legal teams to adapt.
blog · hackenproof.com
How to Create a Vulnerability Disclosure Program for Crypto Business
A guide to creating a vulnerability disclosure program for crypto businesses: why it matters, the standards from NIST and ISO to GDPR, and what a VDP should contain.
blog · projectzero.google
Feedback and data-driven updates to Google’s disclosure policy
A Google Project Zero announcement on feedback and data-driven updates to Google's vulnerability disclosure policy.
blog · netspi.com
Vulnerability Disclosure Submission Standard?
The author argues the industry lacks a standard vulnerability disclosure channel and proposes RFC2142 mailboxes such as security@ and abuse@ as a simple convention for routing reports.
vulnerability · hackerone.com
Vulnerability Disclosure | What’s the Responsible Solution?
Explains how vulnerability disclosure works, why friction arises between researchers and organizations over timing, and the coordinated disclosure practices that keep both sides constructive.
Back