Establish coordinated vulnerability disclosure program for DevOps
Implementation Effort: Medium – Publishing a disclosure policy and standing up an intake and SLA-based triage process is a multi-step effort across security and legal teams. User Impact: Low – Running a disclosure program is a security-team process for handling external reports; end users are not affected. Lifecycle Stage: Govern
Overview
Establish a coordinated vulnerability disclosure (CVD) program so external security researchers, customers, and partners have a clear, governed channel to report security vulnerabilities in your organization's software. Without a published disclosure policy, researchers who discover vulnerabilities in your code, APIs, or published packages have no sanctioned way to report them — increasing the likelihood that findings are disclosed publicly without notice, sold to threat actors, or simply abandoned without your knowledge.
A vulnerability disclosure program should start with a published security policy, such as SECURITY.md in every public GitHub repository or equivalent documentation for Azure DevOps projects. The policy should describe how to report vulnerabilities, what is in scope, expected response timelines, and safe-harbor language that protects good-faith researchers from legal action.
The program also needs an intake process that routes incoming reports to the security team with SLA-based triage. Acknowledge receipt within 48 hours, provide a substantive response within 10 business days, and define a coordinated disclosure timeline, typically 90 days, that gives your team time to develop, test, and deploy a fix before details are published.
Integrate disclosure findings into your DevSecOps vulnerability management workflow so externally reported issues follow the same prioritization, remediation, and verification process as scanner-detected findings. For organizations that publish open-source software, NuGet packages, npm modules, or container images, a vulnerability disclosure program supports CISA secure software development attestation expectations and directly maps to NIST SSDF RV.1.3 (coordinated vulnerability disclosure).
GitHub provides built-in private vulnerability reporting for public repositories, which allows researchers to report issues directly through the Security tab without public disclosure.
A coordinated disclosure program reflects the Assume breach principle — accepting that exploitable flaws will exist and reach outside researchers — by providing a governed channel to surface and remediate them before they are weaponized.