Responsible Disclosure

Responsible disclosure is the informal name for the practice in which a security researcher who discovers a vulnerability privately notifies the affected vendor before publishing any details publicly. The researcher allows the vendor a reasonable period - historically 90 days, established by Google Project Zero - to develop and release a fix. After the fix is released or the deadline passes, the researcher may publish their findings. Responsible disclosure emerged in the 1990s as a compromise between 'full disclosure' (immediate public release) and 'non-disclosure' (keeping findings secret indefinitely). It is now largely superseded in formal regulatory language by coordinated vulnerability disclosure (CVD), which adds more structure and process.

The EU Cyber Resilience Act uses the term coordinated vulnerability disclosure (CVD), not responsible disclosure. The distinction is important:

• Responsible disclosure is researcher-driven - the researcher sets the timeline and controls disclosure.
• CVD is process-driven - it is a structured, bilateral process with documented policies, SLAs, and mutual obligations on both the researcher and the manufacturer.

The CRA's Article 13(6) obligation falls on the manufacturer: to establish and maintain a CVD policy that creates a structured, trustworthy process. Responsible disclosure depends on researcher goodwill; CVD creates a replicable, auditable compliance artefact.

A critical element of both responsible disclosure and CVD is safe harbour: an explicit statement from the manufacturer that good-faith security researchers who follow the published CVD policy will not face legal action. Without safe harbour, researchers who test products for vulnerabilities risk prosecution under computer crime laws or civil litigation under intellectual property law. The CRA's Recital 63 and ENISA's CVD Good Practice Guide both emphasise that manufacturers should explicitly grant safe harbour in their CVD policies. A safe harbour clause should specify:

• What testing activities are permitted.
• The notification process that grants safe harbour protection.
• The scope of products covered.
• Exclusions (e.g. customer data access, destructive testing).

Responsible disclosure depends on good faith from both parties. Failures occur when:

• Vendors ignore reports - researchers who receive no response after repeated attempts publish anyway; this is not a disclosure failure on the researcher's part.
• Vendors threaten legal action - researchers who face cease-and-desist letters typically respond with immediate full public disclosure.
• No published contact channel - researchers cannot disclose responsibly to a vendor they cannot reach.
• Excessive delay - vendors who repeatedly extend remediation timelines without justification lose the researcher's cooperation.

The CRA's mandatory CVD policy requirement addresses these failures by creating a formal legal obligation on manufacturers to maintain an accessible, trustworthy disclosure process.