Sign in Subscribe

Research

Vulnerability disclosure research and bug bounty insights

Above the Parapets: The Chilling Effect Finally Has Receipts

Above the Parapets: The Chilling Effect Finally Has Receipts

The first qualitative study of researchers' lived experiences of legal risk: Sunoo Park and Daniel R. Thomas (USENIX Security 2026) on how overbroad anti-hacking law chills good-faith security research — and why it names disclose.io as part of the fix.

disclose.io/threats: documenting legal threats against security researchers

disclose.io/threats: documenting legal threats against security researchers

A structured, public archive of legal threats, cease-and-desist letters, and prosecutions against security researchers engaged in good-faith vulnerability disclosure. The evidence base for policy reform.

A brief history of vulnerability disclosure and bug bounty

A brief history of vulnerability disclosure and bug bounty

Explore the evolution of vulnerability disclosure from the early days of full disclosure debates through the emergence of bug bounty programs. A comprehensive three-part series by Dennis Fisher covering the history that shaped modern security research.

Establishing asset ownership in vulnerability reporting

Establishing asset ownership in vulnerability reporting

How do you verify who actually owns an asset when reporting a vulnerability? This guide covers techniques for establishing asset ownership, avoiding reporting to the wrong party, and ensuring your security research reaches the right people.