Sign in Subscribe

Tools

disclose.io tools, templates, and resources

disclose.io/threats: documenting legal threats against security researchers

disclose.io/threats: documenting legal threats against security researchers

A structured, public archive of legal threats, cease-and-desist letters, and prosecutions against security researchers engaged in good-faith vulnerability disclosure. The evidence base for policy reform.

The disclose.io Maturity Model: a six-level ladder for vulnerability disclosure programs

The disclose.io Maturity Model: a six-level ladder for vulnerability disclosure programs

The disclose.io Maturity Model is a six-level ladder — from 'no contact' to 'full safe harbor with CVD' — that underpins every entry in the new directory. Here's how it works, and who it's for.

Introducing lookup.disclose.io: One Tool to Find All Security Contacts (Now in Beta)

Introducing lookup.disclose.io: One Tool to Find All Security Contacts (Now in Beta)

Announcing lookup.disclose.io beta: universal security contact lookup for any digital asset. Find bug bounty programs, security.txt, and VDP contacts instantly.

Modes of Public Vulnerability Disclosure: A 2026 Update

Modes of Public Vulnerability Disclosure: A 2026 Update

Understanding the taxonomy of vulnerability disclosure—from private to full to coordinated—and why the industry has converged on 90 days as the rational baseline. Updated for 2026 with the latest from disclose.io Policymaker.

dnssecuritytxt

dnssecuritytxt

DNS-based discovery of security.txt files using the _securitytxt TXT record. Learn how dnssecuritytxt enables organizations to publish vulnerability disclosure contact information through DNS, complementing the traditional .well-known/security.txt approach.

Establishing asset ownership in vulnerability reporting

Establishing asset ownership in vulnerability reporting

How do you verify who actually owns an asset when reporting a vulnerability? This guide covers techniques for establishing asset ownership, avoiding reporting to the wrong party, and ensuring your security research reaches the right people.