A Researcher Centric Approach to Coordinated Vulnerability Disclosure
summary
Proposes a researcher‑centric CVD model where a dedicated coordination team validates findings, identifies the correct supplier, opens communication channels and manages timelines so researchers only deliver reproducible reports. Recommends concrete practices: one business day acknowledgement, no legal obligations on intake, multiple public contact points and an intake form that asks if reports are AI‑generated and for PoC steps. Emphasizes faster fixes, continual updates, and CVE issuance to reduce duplicate reports and public disclosures.
AI-written summary · about
chapters (8)
- 0:00Coordinated vulnerability disclosure intro
- 1:05Vulnerability discovery and reporting
- 13:06Researcher burden in CVD
- 16:35Bug bounty vs CVD
- 20:25AI challenges in vulnerability discovery
- 22:30Resurfacing issues in CVD
- 28:14Researcher-centric vulnerability handling
- 32:31Final thoughts and Q&A
related talks
27mEstablishing a Global Community of Practice on Coordinated Vulnerability Disclosure (CVD)
45mSimplifying Coordinating Vulnerabilities & Disclosures in Open Source...
01h 04mOpen Discussion - International Challenges with CVD, CNA, and CVE
01h 00mAdventures in Vulnerability Coordination
18mWhat You Need to Know and Do about Vulnerability Disclosure
01h 08mPreparing for Zero-Day: Vulnerability Disclosure in Open Source Software
24mTowards a Vulnerability Reporting Specification
11mVulnerability Supply Chains