---
title: "Responsible Disclosure"
canonical: https://trickest.com/glossary/responsible-disclosure
description: "Responsible disclosure has a researcher privately report a vulnerability to the vendor and give time to fix it before any public details appear."
---

# Responsible Disclosure

Responsible disclosure sets the process a researcher follows after finding a flaw: report it privately to the vendor or maintainer, agree on a timeline, and hold public details until a fix ships or the window closes. Most programs settle on a fixed period (90 days is common, popularized by Google's Project Zero), after which the researcher may publish regardless, which keeps vendors from sitting on a report indefinitely.

The model matters because the alternatives both fail users. Full immediate disclosure hands a working bug to attackers before a patch exists. Silence leaves the flaw live and rewards no one. Coordinated timing gives defenders a chance to remediate while still crediting the researcher and pushing the vendor to act.

A clean report pairs well with a [proof of concept](/glossary/proof-of-concept) so the vendor can reproduce the issue fast. Many findings flow through a [bug bounty](/glossary/bug-bounty) program with disclosure terms baked in, and a confirmed fix usually earns a [CVE](/glossary/cve). When a vendor ignores a report and an attacker exploits the flaw first, it becomes a [zero-day](/glossary/zero-day).

In a Trickest workflow the discovery side produces the evidence and PoC; the disclosure step stays a human decision, governed by the program's policy and the agreed timeline.

---
_Markdown source of https://trickest.com/glossary/responsible-disclosure._