title: Towards a Greater Understanding of Coordinated Vulnerability Disclosure Policy Documents
abstract: Bug bounty programmes and vulnerability disclosure programmes, collectively referred to as Coordinated Vulnerability Disclosure (CVD) programmes, open up an organisation’s assets to the inquisitive gaze of (often eager) white-hat hackers. Motivated by the question What information do organisations convey to hackers through public CVD policy documents? , we aim to better understand the information available to hackers wishing to participate in the search for vulnerabilities. As such, in this arti
journal: Digital Threats Research and Practice