Responsible Disclosure
Responsible Disclosure
Verantwortungsvolle Offenlegung
Responsible disclosure denotes the practice of first reporting a discovered vulnerability confidentially to the vendor and giving it time to fix it before details are published. It is the older term for what is today usually called coordinated disclosure (CVD). The core idea: protect users rather than show off the find.
History & facts. The term arose as a counter-design to full disclosure and stressed the finder's responsibility. The word „responsible“ was later criticised because it implicitly labels every other route „irresponsible“ and shifts the power balance in favour of vendors — hence the move to the more neutral, partnership-based term of coordinated disclosure (CVD), detailed in the standards ISO/IEC 29147 and 30111.
Outlook & recommendation. In substance both amount to the same: report confidentially, agree a timeline together, then publish. For organisations it is decisive to offer an easily findable reporting channel at all (such as a security.txt or a clear contact) — because a finder who does not know where to turn will, in case of doubt, choose the public route. With the Cyber Resilience Act (CRA) such a process becomes effectively mandatory for manufacturers.