Policy Pulse - Issue #1 | Week of February 1, 2026
Your weekly briefing on cybersecurity policy affecting vulnerability disclosure and security research.
Research on legal risk experiences — seeking interviewees
Academic research exploring the legal risks security researchers face when discovering and reporting vulnerabilities. If you've experienced legal threats or prosecution related to security research, your story could help shape better protections.
The disclose.io Community Forum is Back—Here’s How to Dive In
The disclose.io community forum has been relaunched with new features for security researchers and organizations. Learn how to join the conversation, connect with fellow researchers, and contribute to safer vulnerability disclosure practices.
Bill Proposal: Unpacking the Cyber Conspiracy Modernization Act
The Cybercrime Conspiracy Modernization Act (CCMA), introduced by Senators Mike Rounds (R-
A brief history of vulnerability disclosure and bug bounty
Explore the evolution of vulnerability disclosure from the early days of full disclosure debates through the emergence of bug bounty programs. A comprehensive three-part series by Dennis Fisher covering the history that shaped modern security research.
Introducing the disclose.io Policymaker!
Introducing the disclose.io Policymaker tool — a free, open-source generator for creating vulnerability disclosure policies. Build compliant VDP and bug bounty policies in minutes with our guided policy builder.
Make DMCA About Copyright Again
The DMCA's anti-circumvention provisions have been misused against security researchers for decades. Here's why we need to return the Digital Millennium Copyright Act to its original purpose and protect good-faith security research.
VIDEO: An intro to disclose.io and hacker safety
Watch this introductory video explaining what disclose.io does, why hacker safety matters, and how organizations can implement vulnerability disclosure programs that protect both researchers and their systems.
dnssecuritytxt
DNS-based discovery of security.txt files using the _securitytxt TXT record. Learn how dnssecuritytxt enables organizations to publish vulnerability disclosure contact information through DNS, complementing the traditional .well-known/security.txt approach.
Establishing asset ownership in vulnerability reporting
How do you verify who actually owns an asset when reporting a vulnerability? This guide covers techniques for establishing asset ownership, avoiding reporting to the wrong party, and ensuring your security research reaches the right people.
Request For Comment: dioterms open-source VDP policy
Request for comment on dioterms, the disclose.io open-source vulnerability disclosure policy template. Help shape the future of standardized VDP language by providing feedback on safe harbor provisions and researcher protections.
2020: A Good Year for Hackers
A look back at 2020's major wins for the security research community — from CFAA reform progress to expanded safe harbor provisions. How the year shaped the future of ethical hacking and vulnerability disclosure.