A brief history of vulnerability disclosure
Major events in the standardization of vulnerability reporting and disclosure
It’s easy to look at the steadily improving relationship between hackers and companies and presume that it has always been this way, but that is far from the truth.
This timeline captures some of the major events in the standardization of vulnerability reporting and disclosure, as well as the origins of The disclose.io Project.
Got a suggestion for this timeline? Send a pull request!
Aug 3, 2018
Disclose.io launch
Sep 2, 2020
CISA BOD 20-01
Sep, 2020
UK Vulnerability Disclosure Toolkit
Jun 3, 2021
Van Buren v. United States
Apr, 2022
RFC 9116 (security.txt)
May 19, 2022
DOJ Good-Faith Security Research Policy
Dec 10, 2024
EU Cyber Resilience Act
May 13, 2025