15.4 Responsible Disclosure and Ethical Reporting Basics
Disclosure Is a Timing Game With a Victim
A vulnerability is simultaneously a research finding and a loaded weapon: the day you confirm it, you know something attackers can use the moment it leaks. Coordinated disclosure is the protocol that manages this asymmetry. The researcher validates impact non-destructively -- read one record to prove an IDOR, do not dump the table; prove the SQL injection with a timing or arithmetic payload, never a data extraction; skip denial-of-service proofs entirely, because availability damage is the one class of harm you cannot undo. Contact goes through the vendor's declared channel: a security.txt file, a PSIRT address, or a bug bounty program page. Staying inside a program's published scope, with its safe-harbor statement, is what separates recognized good-faith research from an unauthorized-access allegation -- public frameworks like the DoD Vulnerability Disclosure Program and the CERT Coordination Center's disclosure policy are the reference models named in most research codes of conduct.
The Embargo and the Patch Window
After a private report, the clock conventionally runs about 90 days from vendor acknowledgment -- the window popularized by Google Project Zero's policy -- long enough to ship a fix through normal release channels, short enough that silence does not become indefinite. Extensions are negotiated, documented, and usually granted for holidays and genuinely complex fixes. During the embargo, a CVE identifier is reserved and assigned through the CVE Program via a numbered CNA (a vendor acting as its own numbering authority, or a root such as MITRE): one shared ID lets patches, advisories, and scanner rules line up without exposing details.
The Public-Dump Branch
Day-zero full disclosure converts an unknown bug into a known exploit for every unpatched install on the planet, and it usually breaches bounty terms and safe-harbor conditions along the way. The ethical branch point is narrow: publish only after a patch ships or the agreed embargo expires, and even then publish a proof-of-concept scaled to the education goal, not to the exploit market. Vendors are not innocent either -- an unanswered inbox for 90 days forfeits the quiet they asked for -- but "they ignored me" does not transfer the risk to their users.
Protecting Availability While Reporting
Operational ethics: throttle your testing, target only assets in scope, never pivot into third-party infrastructure behind a CDN or SaaS dependency, and if the bug lets you affect other users, prove it on your own accounts only. A report the vendor can reproduce in minutes, with no collateral damage, is the difference between a fixed bug and a lawsuit.
Architecture Diagram
Key Takeaways
- Validate impact non-destructively: one record proves the bug; dumping the database is not part of research.
- Use declared channels (security.txt, PSIRT, bounty scope) and stay in scope -- that is the safe-harbor boundary.
- The 90-day embargo from acknowledgment is the coordination norm; extensions are negotiated, not assumed.
- CVE IDs reserved through the CVE Program and CNAs let patches, advisories, and detections share one identifier.
- Immediate public dumps externalize risk onto unpatched users and void good-faith protections.