This article presents what it claims is the generally accepted approach, makes a viable case for why the author thinks it should be the generally accepted approach, but doesn’t actually back up why they think it really is generally accepted.
A reminder that coordinated disclosure is an option but if you’ve identified a security problem outside of contracted work, you can make your own assessment about how you proceed.
Security.txt is a standard for sharing vuln disclosure information; /.well-known/security.txt or /security.txt .
security.txt: https://en.wikipedia.org/wiki/Security.txt
Responsible disclosure -> CVD: Coordinated Vulnerability Disclosure: https://en.wikipedia.org/wiki/Coordinated_vulnerability_disc...
OWASP Vulnerability Disclosure Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability...
This article presents what it claims is the generally accepted approach, makes a viable case for why the author thinks it should be the generally accepted approach, but doesn’t actually back up why they think it really is generally accepted.
A reminder that coordinated disclosure is an option but if you’ve identified a security problem outside of contracted work, you can make your own assessment about how you proceed.