Vulnerability Disclosure — Vocabulary and Communication
Learn vocabulary for responsible disclosure: CVE process, disclosure timelines, and coordination with vendors.
0 / 10 completed
1 / 10
What is 'responsible disclosure' (also called 'coordinated disclosure')?
Responsible/coordinated disclosure: the researcher privately notifies the vendor with full details, gives a reasonable remediation window (typically 90 days — Google Project Zero's standard), then discloses publicly whether or not a fix is ready. Balances vendor time-to-fix with public accountability.
2 / 10
What is a CVE (Common Vulnerabilities and Exposures) identifier?
A CVE ID is a unique, standardized identifier assigned by CVE Numbering Authorities (CNAs) — including MITRE, major vendors, and research organizations. CVE IDs allow consistent cross-referencing of vulnerabilities across security tools, advisories, patch notes, and databases like NVD.
3 / 10
What is a 'bug bounty program' in security vocabulary?
Bug bounty programs incentivize external researchers to find vulnerabilities by offering rewards (cash, swag, recognition). Platforms include HackerOne and Bugcrowd. Programs define scope, reward tiers, disclosure rules, and response SLAs — creating a structured, legal channel for external security research.
4 / 10
What is 'full disclosure' in security vocabulary?
Full disclosure means immediately releasing complete vulnerability details publicly — including PoC exploit code — often to pressure vendors who have been unresponsive. Controversial: it protects the public by enabling workarounds but also arms attackers before patches are available.
5 / 10
What is a 'disclosure timeline' in security research vocabulary?
A disclosure timeline documents the coordination process: T+0 (researcher reports to vendor), T+X (vendor acknowledges), T+90 (typical deadline for a fix), T+90+ (public disclosure). Having a clear timeline holds vendors accountable and sets expectations for both parties.
6 / 10
Review Comment: 'I'm seeing a potential XSS vulnerability here. The input field isn't properly sanitized before being used in the JavaScript rendering engine. Consider using output encoding or a templating library to mitigate this.' What does 'output encoding' primarily refer to?
Output encoding converts potentially harmful characters in user input into safe representations before they're displayed or used within a context (like HTML). This prevents malicious code from being executed. Option A describes vulnerability scanning; options C and D relate to different security strategies. The core concept here is transforming the *output* of data, not patching vulnerabilities themselves.
7 / 10
Slack Message: '@security_team, we've identified a possible SSRF vulnerability in the image processing service. Initial tests suggest it's exploitable via crafted URLs. Requesting urgent assessment.' What is an 'SSRF' (Server-Side Request Forgery) vulnerability and why is this Slack message raising concerns?
An SSRF vulnerability allows an attacker to trick a server into making requests to other resources – often internal ones – that it shouldn't access. The Slack message is concerning because the image processing service *could* be used to probe for sensitive information or interact with internal systems via these forged requests. Options A, C and D describe different attacks.
8 / 10
PR Description: 'Implemented a new feature to allow users to upload images directly to the server. Added validation for file types and sizes. This resolves issue #123.' What is the primary risk associated with allowing direct image uploads without robust security controls, as highlighted by this PR description?
While efficient compression and cloud storage are beneficial, the core risk here is that an attacker could upload a file containing malicious code or data – bypassing the validation steps. This could lead to serious vulnerabilities like remote code execution (RCE) or information disclosure. The PR description focuses on *features*, not necessarily their security implications.
9 / 10
Standup Update: 'I spent the morning investigating a potential vulnerability in our authentication module. I've submitted a detailed report with steps to reproduce and my initial findings to @security_team for review.' What does 'detailed report with steps to reproduce' imply in the context of vulnerability disclosure?
Providing a 'detailed report with steps to reproduce' is vital for effective vulnerability disclosure. It allows security teams to independently verify the issue and understand its scope – enabling them to prioritize remediation efforts efficiently. The goal is to facilitate a clear and repeatable investigative process.
10 / 10
API Response: (Simulated API response from an image processing service) `{"status": "success", "message": "Image uploaded successfully", "file_id": "abc123xyz"}`. The system is configured to allow uploads of images with filenames containing special characters. What potential security concern arises from this configuration, even if the upload appears successful?
Allowing special characters in filenames creates opportunities for attackers to exploit techniques like command injection (if the filename is used in shell commands) or path traversal (if the filename is used to access files outside the intended directory). The API response itself doesn't indicate a vulnerability; it's the *configuration* that introduces the risk.
What will I practise in "Vulnerability Disclosure — Vocabulary and Communication"?
This module focuses on Pentest Communication — real workplace phrasing you'll use on the job. It contains 10 scenario-based multiple-choice questions with instant feedback.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account or sign-up required.
How many questions does this exercise have?
This module includes 10 questions. Each one gives an immediate right/wrong result plus a full explanation of the correct phrasing.
What happens if I answer a question incorrectly?
You'll see the correct answer highlighted straight away, along with a plain-English explanation of why it's right and why the other options don't fit — mistakes are part of the learning here.
Can I retry the exercise if I want a better score?
Yes — use the 'Try again' button on the results screen to reset your score and go through the questions again. There's no limit on attempts.
Who is this Pentest Communication exercise for?
It's aimed at IT professionals with working English who want to sound more natural and precise around pentest communication — useful whether you're preparing for real conversations at work or just building confidence with the vocabulary.
Do I need an account to track my progress?
No account is needed. Your progress through the exercise is tracked locally in your browser for the current session, and you can replay the module at any time.
How is this different from reading a blog article?
This exercise is an interactive drill that tests and reinforces specific phrasing through multiple-choice questions with instant feedback, while blog articles explain concepts and vocabulary in prose. The two work well together.
Where can I find more Pentest Communication exercises?
See the Pentest Communication hub for more modules like this one, or browse the full Exercises page for other IT-English topics.
Can I complete this exercise on my phone?
Yes — every exercise on CoderSlingo is fully responsive and works on phones and tablets, so you can practise anywhere.