Coordinated vulnerability disclosure
By SealSec · July 30, 2026
Coordinated vulnerability disclosure (CVD) is the practice of receiving vulnerability reports from outside researchers and fixing the issues before any details become public. The researcher and the organization coordinate the timeline together, so users are protected while the fix is being built.
The term replaced "responsible disclosure" in most of Europe. The Dutch NCSC published its Coordinated Vulnerability Disclosure guideline in 2019 as a revision of its 2013 responsible disclosure guideline, putting more weight on communication and on the human side of handling a report.
How it works
1. Report. A researcher finds an issue and reports it through the channel you published, usually a security page or a dedicated mailbox.
2. Triage. You confirm the finding, assess the impact and agree on a timeline with the reporter.
3. Fix and verify. You patch the issue and let the reporter validate the fix, the same fix-and-retest loop a good pentest ends with.
4. Disclose. Once users are safe, you publish together and credit the finder.
What a CVD policy contains
Following the NCSC guideline, a usable policy is short and concrete:
A contact method for secure communication, so reports do not land in a shared inbox.
Ground rules for researchers: what is in scope, and what (like denial of service or social engineering) is not.
What a reporter can expect from you: an acknowledgment, a realistic timeline, and no legal threats for good-faith research.
Whether and how you reward reports.
Why SaaS teams should care
A published CVD policy is one of the cheapest trust signals a SaaS company can ship. It tells enterprise buyers that a stranger who finds a hole in your product, for example a broken tenant isolation check, has a safe route to tell you before anyone else finds it.