# What is Coordinated Disclosure?

*Development · Last updated: October 23, 2026*

> Coordinated Vulnerability Disclosure

It is the process of keeping a security vulnerability confidential until the system owner takes precautions, and then publicly disclosing it in a planned manner.

## Overview

Coordinated vulnerability disclosure is a collaboration model between cybersecurity researchers and software vendors. Instead of immediately announcing a discovered critical vulnerability to everyone, the researcher first notifies the developer and allows a reasonable amount of time for a patch to be prepared. After the fix is published, the vulnerability is shared with the public, encouraging users to update their systems.

***Analogy:** It is similar to a locksmith who finds a flaw in a building's door lock, reporting it to the building manager first instead of shouting it to thieves on the street, and reporting it after the lock is changed.*

## How it works

The researcher detects the vulnerability and sends a private report containing technical details to the vendor's security team. The parties agree on a specific timeline for a resolution. The finding is officially disclosed as soon as the vendor prepares and publishes the patch or at the end of the agreed-upon period.

## Where it is used

It is applied in responsible cybersecurity research, bug bounty programs, and the security processes of major technology companies.

## Commonly confused with

It is confused with full disclosure. In full disclosure, the vulnerability is announced directly to the public without any precautions being taken; in coordinated disclosure, a patch is awaited first.

## Questions and answers

**What happens if the company does not fix the vulnerability?**

Researchers typically reserve the right to publicly disclose the vulnerability after a reasonable period of 60 or 90 days in order to protect users.

**How does this process differ from hacker attacks?**

The researcher does not exploit the vulnerability for gain; on the contrary, they cooperate with the vendor to protect the system and make it secure.

## Related terms

- [Zero-day Exploit](https://trescout.com/en/dictionary/zero-day/)
- [Vulnerability Scanning](https://trescout.com/en/dictionary/vulnerability-scanning/)
- [Patch](https://trescout.com/en/dictionary/patch/)
- [Penetration Testing](https://trescout.com/en/dictionary/penetration-testing/)
- [Exploit](https://trescout.com/en/dictionary/exploit/)

This explanation was written in plain language for TreScout with AI and **machine-translated** from the Turkish original · the Turkish version prevails. If something looks wrong or missing, write to [hello@trescout.com](mailto:hello@trescout.com). [Read in Turkish →](https://trescout.com/dictionary/coordinated-disclosure/)

---
Source: TreScout Dictionary · https://trescout.com/en/dictionary/coordinated-disclosure/