What Makes a Vulnerability Report Excellent
curl maintainer Daniel Stenberg has triaged 1,000+ vulnerability reports. His field guide on reporting well is the other half of safe harbor — and the antidote to AI-generated slop.
Disclose.io
Policy Pulse - Issue #22 | Week of June 28, 2026
GPT-5.6 Sol joins Mythos 5 behind the federal access wall as the US government locks in its frontier AI gatekeeping regime. UK CMA reform's statutory defence covers only 300 of 69,600 researchers. DMCA Section 1201 petitions open through August 24.
Feedback Requested: Coordination is going API-first. Contact Discovery and Attribution still aren't solved.
Vulnerability coordination is going API- and MCP-driven, but attribution and contact discovery are still the hard part. What's new in lookup.disclose.io — and where we want your feedback.
Policy Pulse - Issue #20 | Week of June 20, 2026
Three days after Anthropic shipped Mythos 5 to vetted defenders, the US government used export control to recall it worldwide. CISA's BOD 26-04 also retires the fixed-deadline KEV model for a risk score.
Policy Pulse - Issue #19 | Week of June 13, 2026
Trump's Executive Order 14409 stands up a federal AI cybersecurity clearinghouse, but benchmarks machine-found vulnerabilities while saying nothing about how they reach defenders. Plus: CISA opens KEV nominations to researchers.
Above the Parapets: The Chilling Effect Finally Has Receipts
The first qualitative study of researchers' lived experiences of legal risk: Sunoo Park and Daniel R. Thomas (USENIX Security 2026) on how overbroad anti-hacking law chills good-faith security research — and why it names disclose.io as part of the fix.
Policy Pulse - Issue #18 | Week of June 6, 2026
Hackers on the Hill returns to DC on June 16, the first Capitol-side researcher-to-policymaker gathering of 2026. The White House signs the Mythos-era AI cybersecurity EO with a 30-day pre-release access window. A longer analysis lands later this week.
Mark Your Calendar: The disclose.io Upcoming Dates Page Is Live
The disclose.io Upcoming Dates page is now live — a shared community calendar tracking policy deadlines, regulations, CFPs, and legislation across the US, EU, UK, and Australia. Plus: show up at Hackers on the Hill, June 16.
Policy Pulse - Issue #17 | Week of May 30, 2026
Microsoft's MSRC invokes the Digital Crimes Unit against the Nightmare Eclipse zero-day drops, and the disclosure community is not having it. UK National Security Bill confirms CMA reform that protects roughly 300 researchers.
Policy Pulse - Issue #16 | Week of May 23, 2026
Peter G. Neumann, who moderated the ACM RISKS Forum for 41 years and helped found the discipline of secure-systems research, died May 17 at 93. CISA opens a public KEV nomination form. Cloudflare publishes its Project Glasswing post-mortem.
Policy Pulse - Issue #15 | Week of May 16, 2026
OpenAI launches Daybreak with 20+ vendor partners, putting a second restricted-access defensive AI consortium next to Anthropic's Glasswing. AISI says autonomous AI cyber capability is now doubling every 4.7 months.
disclose.io/platforms: a community-maintained list of every bug bounty and VDP platform we know about
A single, canonical, community-maintained list of every bug bounty and vulnerability disclosure platform we know about — global, regional, and vertical-specific. Vendor-agnostic by design.