Responsible Disclosure — Ethics and Law
You have found something serious. A production web application is running a SQL injection vulnerability, user data is at risk, and you are the only person who knows. What you do in the next few minutes determines whether you are a security professional, a liability, or a criminal.
This is not a hypothetical edge case. Every security researcher — at some point in their career — faces exactly this scenario. The decisions that follow are governed by a framework called responsible disclosure, and understanding it is as important as any technical skill in your toolkit.
What is responsible disclosure?
Responsible disclosure (also called coordinated vulnerability disclosure) is a structured agreement between security researchers and software vendors. The researcher privately notifies the vendor of the vulnerability, gives them a defined window — typically 90 days — to develop and release a fix, and then publishes a write-up after the patch is available.
The 90-day timeline was popularized by Google's Project Zero team in 2014 and is now the de facto industry standard. It is long enough for a competent vendor to triage and fix a well-reported vulnerability. It is short enough to prevent vendors from ignoring reports indefinitely while users remain exposed.
Why it matters — protecting users
The fundamental purpose of responsible disclosure is to protect the people using vulnerable software. If a researcher publishes attack details before a patch exists, every attacker in the world gains the same information simultaneously. The vendor, the system administrators, and the users are left racing against an adversary who already has working exploit code.
Conversely, if vulnerabilities are never disclosed — suppressed through non-disclosure agreements or researcher silence — vendors have no incentive to fix them and users have no ability to protect themselves.
Responsible disclosure threads the needle: vendors get a structured, reasonable window to fix the problem. Users are protected because the patch exists before the public knows an attack is possible. Researchers get public credit for their work through CVE assignment and coordinated advisories.
The legal landscape for security researchers
Security research exists in a complex legal environment. In the United States, the Computer Fraud and Abuse Act (CFAA) criminalizes unauthorized access to computer systems. Even well-intentioned researchers testing systems they are authorized to access can inadvertently cross legal boundaries.
Bug bounty programs address this through safe harbor clauses — written statements that authorize specific research activities within defined scope and commit the organization to not pursuing legal action against good-faith researchers. Before testing any system, the first question must always be: "Do I have written authorization?"
When researchers follow responsible disclosure norms — private report, reasonable timeline, coordinated public release — they build a documented record of professional conduct that provides meaningful legal and reputational protection.
What you will practice in this lab
This lab presents you with a three-node decision tree representing the key ethical and legal decision points in a real disclosure scenario. You will:
- Choose how to respond after discovering a vulnerability during authorized testing
- Decide how to handle a vendor's request for a timeline extension
- Determine the correct course of action after a patch has been released
After the decision tree, you will face a scenario-based written question about vendor non-response, and a knowledge quiz covering CVE assignment.
By the end of this lab, you will be able to articulate the responsible disclosure process, the legal framework that governs it, and the escalation path when vendors fail to respond — skills that are fundamental to professional security work.