Coordinated Vulnerability Disclosure

Coordinated vulnerability disclosure (CVD) is a process through which a security flaw is privately reported to the affected organisation before technical details are made public. The discoverer, system owner and, where necessary, a coordinator work within a time-bound process so that the flaw can be verified and remedied while avoiding premature exposure.

How the process works

CVD replaces immediate public disclosure with structured communication and remediation.

• The researcher submits a reproducible report through a designated reporting channel and initially withholds sensitive technical details from the public.
• The system owner validates the flaw, assesses affected products or services, and develops and tests a patch or mitigation.
• A coordinator such as CERT-In may connect researchers, vendors and other affected parties when several systems or organisations are involved.
• An advisory is normally published after remediation is available or the agreed disclosure timeline expires, enabling users to take protective action.

How it reduces risk

• Temporary confidentiality narrows the period in which attackers possess actionable information while defenders remain unprepared.
• Advance notice gives vendors time to fix the root cause and allows operators to deploy updates, configuration changes or temporary controls.
• Coordination helps notify downstream vendors and users whose systems share the same component, reducing fragmented responses and supply-chain exposure.
• Eventual disclosure improves transparency, informs users about residual risk and creates incentives for timely remediation.

Conditions for effectiveness

CVD manages risk but does not guarantee that attackers have not independently found the flaw. A credible policy should specify the testing scope, contact method, expected response, handling of reports and disclosure timeline.

• Disclosure should be time-bound, since indefinite secrecy can leave users unknowingly exposed.
• CVD must complement secure development, continuous monitoring and incident response, rather than substitute for them.
• For AI-enabled systems, it can address security weaknesses in software, interfaces, data pipelines and access controls, although broader model-safety failures may require additional evaluation and governance.