Responsible Disclosure Guidelines

Writing a Report That Gets Acted On

A good vulnerability report saves everyone time. The person reading it may not be the developer who wrote the affected code, so aim for a write-up that a stranger could follow without asking you a single clarifying question. A clear structure helps:

1. Summary: one or two sentences naming the affected component and the class of issue, such as stored cross-site scripting in a comment field or an authentication bypass on a login form.
2. Environment: the URL or version you tested, your browser or client, and any configuration that matters.
3. Reproduction steps: numbered, minimal and in order. Strip out anything that is not needed to trigger the bug.
4. Impact: what an attacker could realistically achieve. Be honest. Overstating severity erodes trust, and understating it can delay a fix.
5. Evidence: request and response snippets or screenshots, with any personal data or credentials redacted.
6. Suggested remediation: this is optional, but welcome if you have a sensible idea.

Staying on the right side of the line

Testing should prove that a problem exists, not push it as far as it will go. Use your own accounts wherever possible. Stop as soon as you have confirmed the issue. Do not download, modify or delete other people's data, and avoid anything that could degrade service for others, such as denial-of-service testing, mass automated scanning or social engineering of staff. If you are unsure whether a step is acceptable, pause and ask before going further.

Laws on computer access differ between jurisdictions. In the United States, statutes such as the Computer Fraud and Abuse Act can apply to unauthorised testing. Good intentions are not a legal shield, so if you have doubts about your own situation, talk to a qualified lawyer.

Timelines and coordination

Coordinated disclosure works best when both sides communicate. Many in the industry treat roughly 90 days as a common reference point between a report and public disclosure. Complex fixes can reasonably take longer, provided progress is shared. If you plan to publish a write-up or present your findings, let us know in advance so the details can be agreed together.

Want to sharpen your reporting skills alongside other researchers? Drop into one of our meetups, or keep an eye on the threat feed to see how real-world issues are described and tracked.