Open-source vulnerability disclosure and bug bounty program database

Tools, data, and contact lists relevant to The disclose.io Project.

Independent research white paper by Jon “GainSec” Gaines examining the security posture of a connected public safety technology ecosystem.

The First Open Source Bug Bounty Platform

Mapping from bug bounty and vulnerability disclosure programs to respective GitHub organizations

Misc bounty and vulndisc things

Open-source vulnerability disclosure policy templates.

Vulnerability analysis and proof of concepts

A standard allowing organizations to nominate security contact points and policies via DNS TXT records.

A Python client for the Global CVE Allocation System.

Vultron is a protocol for Coordinated Vulnerability Disclosure

A free, open-source, multi-lingual, template-based VDP policy, safe harbor clause, securitytxt, and DNS Security TXT generator.

Content for the CERT Guide to Coordinated Vulnerability Disclosure

A collection of templates for generating vulnerability disclosure policies. (NOTE: As of 2024, these templates are now part of the CERT Guide to Coordinated Vulnerability Disclosure, see link in README.)

The Disclose.io Status best practice seal.

Exploit and report for CVE-2023-23396.

🍵 Specification for security commit messages

Silent dependency injection through AI documentation pipelines. 240 isolated Docker runs proving Context Hub's zero-sanitization MCP server lets poisoned docs compromise developer projects without warning.

A curated list of Public Bug Bounty, Responsible Disclosure, Vulnerability Disclosure Programs sourced from Community & Internet.

CVE-2026-32662: Active Debug Code in Production — Gardyn Home Kit (ICSA-26-055-03)