Coordinated disclosure policy

The canonical version of this policy lives in our security-research repository on GitHub, alongside our advisory database. This page mirrors it word for word and is updated automatically when it changes. Advisories we’ve published are listed under research.

The Blackwing Intelligence research team is dedicated to protecting users. We view vulnerability disclosure as a collaborative process aimed at safeguarding users, which is why Blackwing adheres to a 90-day disclosure deadline.

When we identify a vulnerability in a project or product as part of our public vulnerability research, we will report it by attempting to contact the publicly listed security contact for the responsible party, if one exists. If no such contact is available, we will attempt to contact the responsible party directly.

If the responsible party responds and agrees that the issue poses a security risk, we will work with their security team or designated individuals to communicate the vulnerability in detail and coordinate the process for public disclosure. The responsibility for developing and releasing a patch lies with the responsible party, although we aim to facilitate this by providing detailed information about the vulnerability.

If the responsible party does not respond, or does not agree the issue poses a security risk, we will still disclose the vulnerability after 90 days have passed.

After notifying responsible parties of vulnerabilities, we will publicly share the details with the defensive community after 90 days or sooner if the responsible party releases a fix. The disclosure deadline may vary in the following ways:

  • If a deadline is due to expire on a weekend or US public holiday, the deadline will be moved to the next normal work day.
  • Before the 90-day deadline has expired, if the responsible party lets us know that a patch is scheduled for release on a specific day that will fall within 14 days following the deadline, we will delay the public disclosure until the availability of the patch.
  • If we observe a 0day (see definition below) vulnerability being actively exploited, we believe more urgent action is appropriate and we may apply a shorter disclosure deadline. We believe it is important that responsible parties disclose that there is evidence to suggest that the vulnerability is under active exploitation.

We reserve the right to adjust deadlines — either bringing them forward or extending them — based on extreme circumstances. However, we remain committed to treating all responsible parties equally.

This policy aligns with our goal of improving industry response times to security bugs, while also allowing for more flexible handling of cases where deadlines are slightly exceeded.

Note: This policy is primarily based on Google’s vulnerability disclosure policy. We join Google in calling on all researchers to adopt disclosure deadlines in some form. Creating pressure towards more reasonably-timed fixes will result in better security outcomes for users.

Terms

  • Responsible Party - Vendors, open source maintainers, and other third parties that are responsible for addressing security vulnerabilities in their products or projects.
  • 0day Vulnerability - A 0day (zero-day) vulnerability refers to a security flaw in software or hardware that is not widely known, regardless of whether a patch is available by the vendor or maintainer. However, once a patch is available, the vulnerability is no longer considered a 0day vulnerability as the technical details of the vulnerability are by definition publicly available as part of the patch.

Frequently Asked Questions

  • Why don’t you use the term responsible disclosure?
    • The term “responsible disclosure”, while possibly well intentioned, carries the implication that researchers who prioritize the protection of users over the interests of vendors by disclosing vulnerability details are acting irresponsibly. We use the term “coordinated disclosure” to emphasize the collaborative nature of the process. We believe that vulnerability disclosure is a two-way street, and that it is important for researchers and vendors to work together to protect users.

Reporting a vulnerability to us

If you believe you’ve found a security issue in this site or in software we publish, email info@blackwinghq.com or message us on Signal. See also our security.txt.