Sign in Subscribe

Tools

disclose.io tools, templates, and resources

Modes of Public Vulnerability Disclosure: A 2026 Update

Modes of Public Vulnerability Disclosure: A 2026 Update

Understanding the taxonomy of vulnerability disclosure—from private to full to coordinated—and why the industry has converged on 90 days as the rational baseline. Updated for 2026 with the latest from disclose.io Policymaker.

Introducing the disclose.io Policymaker!

Introducing the disclose.io Policymaker!

Introducing the disclose.io Policymaker tool — a free, open-source generator for creating vulnerability disclosure policies. Build compliant VDP and bug bounty policies in minutes with our guided policy builder.

dnssecuritytxt

dnssecuritytxt

DNS-based discovery of security.txt files using the _securitytxt TXT record. Learn how dnssecuritytxt enables organizations to publish vulnerability disclosure contact information through DNS, complementing the traditional .well-known/security.txt approach.

Establishing asset ownership in vulnerability reporting

Establishing asset ownership in vulnerability reporting

How do you verify who actually owns an asset when reporting a vulnerability? This guide covers techniques for establishing asset ownership, avoiding reporting to the wrong party, and ensuring your security research reaches the right people.

Request For Comment: dioterms open-source VDP policy

Request For Comment: dioterms open-source VDP policy

Request for comment on dioterms, the disclose.io open-source vulnerability disclosure policy template. Help shape the future of standardized VDP language by providing feedback on safe harbor provisions and researcher protections.