Sign in Subscribe

Tools

disclose.io tools, templates, and resources

What Vegas Told Us About lookup.disclose.io, and What We Changed

What Vegas Told Us About lookup.disclose.io, and What We Changed

We took lookup.disclose.io to Black Hat and DEF CON 34 and asked people to break it. Here are the exact reports we got back, the fixes that shipped within days, the seven integrations that went from roadmap to public in the three weeks since, and who this thing turned out to be for.

DNS Security TXT, Five Years On

DNS Security TXT, Five Years On

Five years after we proposed publishing your security contact in DNS, the standard has one canonical home, a required freshness field, an Internet-Draft, and 181 domains found in the wild.

Bring lookup.disclose.io Into Your Workflow

Bring lookup.disclose.io Into Your Workflow

lookup.disclose.io now plugs into the tools you already use: a CLI, Caido and Burp Suite plugins, an MCP server for AI agents, plus the web app and API. Try them, and tell us what to fix.

Feedback Requested: Coordination is going API-first. Contact Discovery and Attribution still aren't solved.

Feedback Requested: Coordination is going API-first. Contact Discovery and Attribution still aren't solved.

Vulnerability coordination is going API- and MCP-driven, but attribution and contact discovery are still the hard part. What's new in lookup.disclose.io — and where we want your feedback.

Mark Your Calendar: The disclose.io Upcoming Dates Page Is Live

Mark Your Calendar: The disclose.io Upcoming Dates Page Is Live

The disclose.io Upcoming Dates page is now live — a shared community calendar tracking policy deadlines, regulations, CFPs, and legislation across the US, EU, UK, and Australia. Plus: show up at Hackers on the Hill, June 16.

disclose.io/platforms: a community-maintained list of every bug bounty and VDP platform we know about

disclose.io/platforms: a community-maintained list of every bug bounty and VDP platform we know about

A single, canonical, community-maintained list of every bug bounty and vulnerability disclosure platform we know about — global, regional, and vertical-specific. Vendor-agnostic by design.

disclose.io/threats: documenting legal threats against security researchers

disclose.io/threats: documenting legal threats against security researchers

A structured, public archive of legal threats, cease-and-desist letters, and prosecutions against security researchers engaged in good-faith vulnerability disclosure. The evidence base for policy reform.

The disclose.io Maturity Model: a six-level ladder for vulnerability disclosure programs

The disclose.io Maturity Model: a six-level ladder for vulnerability disclosure programs

The disclose.io Maturity Model is a six-level ladder — from 'no contact' to 'full safe harbor with CVD' — that underpins every entry in the new directory. Here's how it works, and who it's for.

Introducing lookup.disclose.io: One Tool to Find All Security Contacts (Now in Beta)

Introducing lookup.disclose.io: One Tool to Find All Security Contacts (Now in Beta)

Announcing lookup.disclose.io beta: universal security contact lookup for any digital asset. Find bug bounty programs, security.txt, and VDP contacts instantly.

Modes of Public Vulnerability Disclosure: A 2026 Update

Modes of Public Vulnerability Disclosure: A 2026 Update

Understanding the taxonomy of vulnerability disclosure—from private to full to coordinated—and why the industry has converged on 90 days as the rational baseline. Updated for 2026 with the latest from disclose.io Policymaker.