Overview
Each program sets disclosure terms governing how and whether findings can be shared publicly. This capstone lesson covers disclosure and consolidates program scope.
Learning objectives
- Explain program disclosure terms.
- Distinguish private reporting from public disclosure.
- Consolidate the program-scope module.
Core concept
Disclosure terms define how findings must be handled regarding publicity: virtually all programs require private reporting (submit through the program, don't disclose publicly), and specify whether/when public disclosure is permitted — often only after a fix and with the program's coordination/permission. Some programs allow coordinated public write-ups after remediation; others require ongoing confidentiality. Following the disclosure terms is mandatory — they protect users (by keeping vulnerabilities private until fixed) and the organization, and they embody responsible/coordinated disclosure in the program context.
How it works
The researcher reports findings privately through the program and does not disclose them publicly unless the disclosure terms explicitly permit it (typically after remediation and with coordination). If the terms allow a coordinated public write-up post-fix, the researcher waits for the fix and the program's go-ahead before publishing. Premature or unauthorized public disclosure — even of a fixed issue, if the terms forbid it — violates the program and can harm users (if unfixed) or the organization. Respecting disclosure terms is part of the program's rules and the responsible-disclosure ethic. When in doubt, the researcher keeps findings confidential and coordinates with the program.
Practical example
A researcher finds and privately reports a vulnerability. The program's disclosure terms permit a coordinated public write-up only after the issue is fixed and with the program's approval. The researcher waits until the organization confirms the fix and grants permission, then publishes a write-up. Had the terms required ongoing confidentiality, they would not publish at all. In neither case do they disclose before a fix or without coordination — respecting the disclosure terms and protecting users and the organization.
Cybersecurity relevance
Disclosure terms operationalize responsible/coordinated disclosure within programs: private reporting and coordinated (post-fix, permitted) public disclosure protect users from exposure and the organization from premature publicity, while allowing researchers appropriate credit/sharing. Violating disclosure terms (premature or unauthorized public disclosure) can harm users, breach the program, and damage trust and the researcher's standing. This consolidates program scope — in-scope assets, exclusions, severity rules, prohibited testing, and disclosure — which together define what, how, and to what end a researcher may test and share, the complete authorization framework for a program, building on the responsible-disclosure fundamentals.
Common mistakes
- Disclosing findings publicly without following the program's disclosure terms.
- Assuming a fixed issue can be shared when the terms require ongoing confidentiality.
- Not coordinating public write-ups with the program.
Key takeaways
- Disclosure terms govern publicity: private reporting is required, and public disclosure (if allowed) is typically only after a fix and with the program's coordination/permission.
- They protect users (vulnerabilities stay private until fixed) and the organization, embodying responsible/coordinated disclosure in the program context.
- Respecting them is mandatory; this consolidates program scope (in-scope assets, exclusions, severity rules, prohibited testing, disclosure) — the complete program authorization framework.
Check your understanding
- What do a program's disclosure terms typically require regarding private reporting and public disclosure?
- Why must a researcher coordinate any public write-up with the program rather than disclosing on their own?