Finding the Bug Is the Easy Part
Anyone with patience and a fuzzer can find a vulnerability. What separates a researcher whose reports get fixed from one whose emails get ignored is everything that happens after the crash. Disclosure is a discipline, and most people are bad at it. Let me walk the full lifecycle the way it should run.
Step 1: Confirm and Constrain
Before you tell anyone anything, you establish exactly what you have.
- Reproduce it deterministically. A bug you can only trigger sometimes is not yet a report; it is a rumor. Reduce it to the smallest, most reliable proof of concept.
- Establish impact precisely. "It crashes" is weak. "Unauthenticated remote attacker achieves memory corruption leading to code execution in the default configuration" is a finding. Map it to a real attacker capability.
- Define the affected versions. Vendors will ask. Know the boundary between vulnerable and not.
Step 2: Write the Advisory Like a Professional
The advisory is your reputation in a text file. A good one is boring in the best way — complete, unambiguous, and free of theatrics.
A solid structure:
Title: Component — vulnerability class (e.g. "Auth bypass in X v2.x")
Affected: Exact products and version ranges
Severity: CVSS vector + your own honest assessment
Summary: Two sentences a busy engineer can act on
Technical detail: Root cause, not just the symptom
Proof of concept: Minimal, reproducible, clearly marked
Impact: What a real attacker gains
Remediation: What fixes it; what mitigates it in the interim
Timeline: Your disclosure intentions, stated up front
Write the technical detail so the vendor's engineer can find the root cause in their own code from your description. You are doing their triage for them. That is how you get a fast fix and a credited advisory.
Step 3: Coordinated Disclosure, Not Drama
Coordinated Vulnerability Disclosure (CVD) is the adult version of this process. The norms:
- Contact privately first. Look for a
security.txt, a security@ address, or a bug bounty program. Many vendors now use platforms that timestamp everything. - State a timeline. Industry convention is roughly 90 days to a fix before public disclosure, with flexibility for vendors acting in good faith and pressure for those who stall.
- Keep records. Every message, dated. If the relationship sours, your timeline is your protection.
- If there is no response, escalate to a coordinator. A CERT/CC or your national CSIRT will broker disclosure when a vendor goes dark.
The goal is a fixed product and a protected user base — not a viral thread. The researchers with long careers understand that the users on the other end of the bug are the actual stakeholders.
Step 4: How a Finding Becomes a CVE
A CVE is just a stable identifier so everyone is talking about the same bug. You request one from a CVE Numbering Authority (CNA) — often the vendor itself, or MITRE as the CNA of last resort. The CVE record carries the affected products, the description, and references. Get the description right; it propagates into every scanner and SBOM tool on earth.
Step 5: The KEV Escalation
Here is the part defenders care about most. When CISA confirms a CVE is being actively exploited in the wild, it lands in the Known Exploited Vulnerabilities catalog. That changes everything:
- Federal civilian agencies are bound to remediate on a hard deadline.
- The private sector should treat a KEV entry as a P0, full stop.
- The exploitation is confirmed, not theoretical — so the math on patching changes from "eventually" to "now."
# Pull the KEV catalog and cross it against your own CVE exposure
import requests
kev = requests.get(
"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
).json()
kev_ids = {v["cveID"] for v in kev["vulnerabilities"]}
my_exposure = load_scanner_results() # your environment's open CVEs
priority = sorted(set(my_exposure) & kev_ids) # patch these first, today
print(f"KEV-confirmed exposures: {len(priority)}")
The Through-Line
Disclosure done right is a chain of custody for risk: a researcher constrains a finding, hands the vendor a fix-ready advisory, the world gets a stable CVE, and — if attackers move first — CISA flags it for everyone. Every link is a discipline. Skip one and you are not a researcher; you are noise with a CVSS score.