PICOFAULT_LAB

Responsible vulnerability disclosure

Coordinated
disclosure

Version 1.0

This policy covers disclosure of vulnerabilities found by Picofault Lab through research or customer work. It gives vendors and open-source projects time to fix issues before a firm publication deadline. Customer non-disclosure agreements and other confidentiality obligations take precedence; the customer decides whether, when, and how any public disclosure occurs.

The disclosure timeline

  1. DAY 00

    Initial reportThe 90-day period begins when we first notify the vendor or project.

  2. DAY 07

    Receipt confirmedThe vendor acknowledges our report within seven calendar days.

  3. DAY 30

    Findings confirmedThe vendor confirms the findings or explains any technical disagreement within 30 calendar days.

  4. DAY 90

    Publication deadlineLate responses do not move this date; we may publish on day 90.

01 / FIRST CONTACT

Reporting a vulnerability

We first report to the vendor or project through its stated official vulnerability reporting channel. We always use encrypted communication.

Each researcher includes their name, role, organization, email address, OpenPGP fingerprint, and public-key information.

If no security contact is published on the vendor or project website, or receipt is not acknowledged within 7 calendar days, we try other public contacts. We may also ask an independent coordinator for help.

We ask the vendor or project to:

  1. 01Confirm receipt within 7 calendar days.
  2. 02Confirm the findings within 30 calendar days, or explain any technical disagreement.
  3. 03Provide updates on fixes, release dates, CVE assignment, and advisories.

02 / THE FIRM DEADLINE

90-day disclosure deadline

The disclosure period starts on the date of the initial report and ends 90 calendar days later. Late responses do not move the deadline.

If a fix is released during this period, we normally wait 14 days before publishing details. This waiting period must end within the original 90 days. If fewer than 14 days remain, we publish on day 90. If no fix is released, we may also publish on day 90.

Publication examples

  1. Fix onDay 47

    Publish onDay 61

    14 days after the fix

  2. Fix onDay 80

    Publish onDay 90

    The original deadline takes precedence

  3. No fix byDay 90

    Publish onDay 90

    Publication may proceed without a fix

We may publish earlier if the vendor informs us that no fix will be issued, the vulnerability is already public or actively exploited, or delay creates an immediate risk to users. Picofault Lab and the vendor may also mutually agree to publish earlier.

We aim to reach agreement on CVSS scores and CWE classifications through technical review. Any remaining disagreement does not extend the deadline.

03 / DOCUMENTATION

Security advisories

After validating a vulnerability, we prepare an advisory containing:

  • a Picofault Lab advisory ID (PFSA-YEAR-NUMBER) and CVE ID, if assigned
  • proposed CVSS 4.0 scores and vectors, and CWE classifications
  • affected products, components, and tested versions
  • a technical description and, where relevant, an in-depth technical analysis
  • the impact
  • reproduction steps and proof-of-concept code, if appropriate
  • fixes and interim mitigations, if known
  • the disclosure deadline and history.

04 / GOING PUBLIC

Publication

We decide case by case how much technical detail to publish and whether to release proof-of-concept code, detection software, or scanners. If no fix is available, we focus on mitigations.

Picofault Lab reserves the right to publish advisories on its website, through other coordinators, news outlets, bloggers, social media, or other channels, and at another agreed location.