DNS Security TXT, Five Years On
Five years after we proposed publishing your security contact in DNS, the standard has one canonical home, a required freshness field, an Internet-Draft, and 181 domains found in the wild.
Tools
disclose.io tools, templates, and resources
Bring lookup.disclose.io Into Your Workflow
lookup.disclose.io now plugs into the tools you already use: a CLI, Caido and Burp Suite plugins, an MCP server for AI agents, plus the web app and API. Try them, and tell us what to fix.
Feedback Requested: Coordination is going API-first. Contact Discovery and Attribution still aren't solved.
Vulnerability coordination is going API- and MCP-driven, but attribution and contact discovery are still the hard part. What's new in lookup.disclose.io — and where we want your feedback.
Mark Your Calendar: The disclose.io Upcoming Dates Page Is Live
The disclose.io Upcoming Dates page is now live — a shared community calendar tracking policy deadlines, regulations, CFPs, and legislation across the US, EU, UK, and Australia. Plus: show up at Hackers on the Hill, June 16.
disclose.io/platforms: a community-maintained list of every bug bounty and VDP platform we know about
A single, canonical, community-maintained list of every bug bounty and vulnerability disclosure platform we know about — global, regional, and vertical-specific. Vendor-agnostic by design.
disclose.io/threats: documenting legal threats against security researchers
A structured, public archive of legal threats, cease-and-desist letters, and prosecutions against security researchers engaged in good-faith vulnerability disclosure. The evidence base for policy reform.
The disclose.io Maturity Model: a six-level ladder for vulnerability disclosure programs
The disclose.io Maturity Model is a six-level ladder — from 'no contact' to 'full safe harbor with CVD' — that underpins every entry in the new directory. Here's how it works, and who it's for.
Introducing lookup.disclose.io: One Tool to Find All Security Contacts (Now in Beta)
Announcing lookup.disclose.io beta: universal security contact lookup for any digital asset. Find bug bounty programs, security.txt, and VDP contacts instantly.
Modes of Public Vulnerability Disclosure: A 2026 Update
Understanding the taxonomy of vulnerability disclosure—from private to full to coordinated—and why the industry has converged on 90 days as the rational baseline. Updated for 2026 with the latest from disclose.io Policymaker.
The disclose.io Community Forum is Back—Here’s How to Dive In
The disclose.io community forum has been relaunched with new features for security researchers and organizations. Learn how to join the conversation, connect with fellow researchers, and contribute to safer vulnerability disclosure practices.
Introducing the disclose.io Policymaker!
Introducing the disclose.io Policymaker tool — a free, open-source generator for creating vulnerability disclosure policies. Build compliant VDP and bug bounty policies in minutes with our guided policy builder.
dnssecuritytxt
DNS-based discovery of security.txt files using the _securitytxt TXT record. Learn how dnssecuritytxt enables organizations to publish vulnerability disclosure contact information through DNS, complementing the traditional .well-known/security.txt approach.