Security Disclosure Language

Responsible disclosure (also called coordinated disclosure) is the practice of privately notifying a vendor about a security vulnerability and allowing them a reasonable time — typically 90 days — to issue a fix before the vulnerability is made public. Researchers say "I will follow responsible disclosure and give the vendor 90 days to patch before publishing my findings." The goal is to protect users while still creating accountability for vendors to act promptly.

A CVE is a unique identifier assigned to a publicly known security vulnerability. When writing or discussing a CVE, engineers use phrases like "CVE-2024-12345 describes a remote code execution vulnerability in version 3.2 of the library" or "the CVE has been assigned a CVSS score of 9.8, indicating critical severity." The CVE ID, CVSS score, affected versions, and patch status are standard components of any CVE discussion.

A strong bug bounty report uses precise, professional language. It includes a clear title such as "Stored XSS via unsanitised user input in profile description field," a severity rating, a step-by-step reproduction guide ("steps to reproduce"), proof of concept code or screenshots, and the potential impact ("an attacker could steal session tokens of any authenticated user"). Researchers begin reports with phrases like "I have identified a security vulnerability in your platform that I would like to disclose responsibly."

Disclosure timelines use terms such as "initial report date," "vendor acknowledgement," "patch release date," "embargo period," and "public disclosure date." Researchers write "the vulnerability was reported on 15 January; the vendor acknowledged receipt on 17 January and committed to a patch within 60 days." If the deadline passes without a fix, researchers say "the embargo has expired" and proceed with limited public disclosure. Google Project Zero's 90-day policy is the most widely cited benchmark.

CVSS (Common Vulnerability Scoring System) scores range from 0 to 10 and are described verbally as: 0.1–3.9 Low, 4.0–6.9 Medium, 7.0–8.9 High, and 9.0–10.0 Critical. Advisories say "this vulnerability has been rated Critical (CVSS 9.8) due to its network-exploitable attack vector and no authentication requirement." The sub-scores — attack vector, attack complexity, privileges required, and user interaction — are discussed when justifying the final rating.

When vendors acknowledge a report, they use formal language: "Thank you for bringing this to our attention. We have confirmed the vulnerability and our security team is actively working on a fix. We request a 60-day embargo to allow us to patch and notify affected customers." When issuing patches, vendors say "we have released version 4.1.2 which addresses CVE-2024-12345. We strongly recommend all users upgrade immediately."

A security bulletin is a formal public notice about a vulnerability and its fix. It typically opens with a severity classification and a brief summary: "A critical remote code execution vulnerability has been identified in Product X versions prior to 5.0." It then describes the vulnerability, affected versions, available mitigations or workarounds, and the patch. The closing always includes urgency language: "Users running affected versions should apply the patch as a matter of urgency."

Impact descriptions use terms such as "remote code execution (RCE)," "privilege escalation," "information disclosure," "denial of service (DoS)," "authentication bypass," and "cross-site scripting (XSS)." Engineers say "exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code with root privileges" or "a successful attack would allow the disclosure of sensitive user data including passwords and payment information."

Proof of concept (PoC) code demonstrates that a vulnerability is exploitable. In disclosures, researchers write "the following PoC reproduces the vulnerability against an unpatched installation" or "I have included a minimal reproduction script that confirms the issue." When sharing with vendors under embargo, researchers note "this PoC should not be shared publicly until a patch is available." After a patch, some researchers publish full PoCs as part of technical writeups for educational purposes.

Bug bounty programmes define scope with phrases like "in-scope assets include all subdomains of example.com," "out-of-scope findings include social engineering and physical attacks," and "we do not award bounties for informational-only findings." Reward tiers are described as "up to $10,000 for critical vulnerabilities" and "up to $500 for low-severity issues." Programme rules use language such as "you must not access or modify user data beyond what is necessary to demonstrate the vulnerability."