disclose.io

What it is

disclose.io describes itself as open infrastructure for safer vulnerability disclosure. It is run as a nonprofit and maintains three things a student should know about:

• dioterms, a set of public domain (CC0) policy templates on GitHub: a basic vulnerability disclosure policy (VDP), a VDP with coordinated disclosure, standalone safe harbour clauses and a bug bounty template.
• A directory of known vulnerability disclosure and bug bounty programmes, with a lookup tool that finds an organisation's security contact, disclosure programme and safe harbour status.
• Policymaker, a generator organisations use to create a disclosure policy and a security.txt file.

Three ideas to understand first

Scope. Every legitimate programme publishes exactly which systems and which kinds of testing are allowed. Anything not listed is out of scope, and testing it is not authorised, even if the same company runs a bug bounty elsewhere.

Safe harbour. Laws against unauthorised computer access exist in most countries, and good intentions are not a legal defence. A safe harbour clause is the organisation's written promise that good faith research within its policy is authorised and will not be pursued legally. The dioterms project lists what a strong clause should include: authorisation under anti-hacking laws, an exemption from anti-circumvention rules, a waiver of conflicting terms of service for in-scope testing, and recognition of good faith research. It also notes that bounties are not a prerequisite for safe harbour.

Coordinated disclosure. You report privately, give the organisation reasonable time to fix the problem, and only publish details afterwards on an agreed timeline. The VDP with CVD template shows what that agreement looks like.

How a student should use it

Before any test outside your own lab or a CTF, look the organisation up in the directory, read its policy, and confirm the asset you are interested in is in scope and covered by safe harbour. Only test systems you own or are explicitly authorised to test: your own lab, a CTF, or an in-scope bug bounty programme. If an organisation has no programme and no policy, do not test it. If you stumble on a problem by accident, stop, do not dig further, and report it through a published security contact.

Free versus paid

Everything is free. The templates are public domain, and the site and directory data are open source on GitHub.

Time needed and prerequisites

No technical background is needed. An hour reading the finder guidance and one or two policy templates is enough to understand the basics, and it is the most useful hour anyone curious about bug bounties can spend.

What you can do afterwards

You will be able to read a programme policy critically, recognise when safe harbour is missing or partial, and write a report that respects scope. Developers benefit too: adding a clear disclosure policy and security.txt to your own project is a small, visible piece of security maturity.

Common questions

Is disclose.io a bug bounty platform? No. It does not pay bounties or host reports; it standardises the policy language and indexes programmes.

Does a safe harbour clause protect me everywhere? It is the organisation's commitment, not a change to the law, and only covers testing that follows the policy. Stay inside scope.