A brief history of vulnerability disclosure

Major events in the standardization of vulnerability reporting and disclosure

It’s easy to look at the steadily improving relationship between hackers and companies and presume that it has always been this way, but that is far from the truth.

This timeline captures some of the major events in the standardization of vulnerability reporting and disclosure, as well as the origins of The disclose.io Project.

Got a suggestion for this timeline? Send a pull request!

Apr 18, 2016

Free ISO 24197

Sep, 2020

UK Vulnerability Disclosure Toolkit

May 19, 2022

DOJ Good-Faith Security Research Policy

May 13, 2025

ENISA European Vulnerability Database