What is Coordinated Disclosure?
Coordinated Vulnerability Disclosure
It is the process of keeping a security vulnerability confidential until the system owner takes precautions, and then publicly disclosing it in a planned manner.
Overview
Coordinated vulnerability disclosure is a collaboration model between cybersecurity researchers and software vendors. Instead of immediately announcing a discovered critical vulnerability to everyone, the researcher first notifies the developer and allows a reasonable amount of time for a patch to be prepared. After the fix is published, the vulnerability is shared with the public, encouraging users to update their systems.
How it works
The researcher detects the vulnerability and sends a private report containing technical details to the vendor's security team. The parties agree on a specific timeline for a resolution. The finding is officially disclosed as soon as the vendor prepares and publishes the patch or at the end of the agreed-upon period.
Where it is used
It is applied in responsible cybersecurity research, bug bounty programs, and the security processes of major technology companies.
Commonly confused with
It is confused with full disclosure. In full disclosure, the vulnerability is announced directly to the public without any precautions being taken; in coordinated disclosure, a patch is awaited first.
Questions and answers
What happens if the company does not fix the vulnerability?
Researchers typically reserve the right to publicly disclose the vulnerability after a reasonable period of 60 or 90 days in order to protect users.
How does this process differ from hacker attacks?
The researcher does not exploit the vulnerability for gain; on the contrary, they cooperate with the vendor to protect the system and make it secure.
Related terms
This explanation was written in plain language for TreScout with AI and machine-translated from the Turkish original · the Turkish version prevails. If something looks wrong or missing, write to hello@trescout.com. Read in Turkish →