The one-sentence version
A security researcher discovers a vulnerability and has several choices: tell the vendor privately, disclose it directly to the public, sell it to the highest bidder, or exploit it themselves. Responsible disclosure (also known as coordinated disclosure) is the industry standard: notify the vendor privately first, provide a reasonable remediation period (commonly 90 days), and then disclose the details publicly.
Bug bounties use monetary rewards to keep researchers on the "white hat" side. For a project, at least two small things are required: publishing a security contact method (security.txt) and promising not to prosecute good-faith researchers.
This article has three layers:
- Layer 1: The Intuition: What to do if you find a neighbor's door unlocked
- Layer 2: Real-World Use: 90-day deadlines, bug bounty platforms, and "white hat negotiations" in the cryptocurrency field
- Layer 3: Principles and engineering key points: security.txt, disclosure workflows, bounty program design, and safe harbor
Layer 1: The Intuition
1.1 Finding a neighbor's door unlocked
You find that a neighbor's door is unlocked. The reasonable thing to do is:
- Tell the neighbor privately;
- Give them time to fix the lock;
- If they never fix it, you can warn other neighbors to be careful (because thieves might notice too).
The unreasonable thing to do is: announce "So-and-so's door is unlocked" in the community group chat (direct disclosure), go inside to take things (exploitation), or sell this information to a thief.
1.2 The Dilemma
| Immediate Disclosure | Permanent Secrecy |
|---|---|
| The vendor cannot fix it in time, and attackers exploit it first | The vendor might never fix it, leaving users in constant danger |
Coordinated disclosure is a compromise between the two: give the vendor a deadline; keep it confidential during the deadline; once the deadline expires, disclose it regardless of whether it has been fixed, forcing the vendor to take it seriously.
Layer 2: Real-World Use
- Google Project Zero's 90-day policy: After Google's vulnerability research team reports a vulnerability to a vendor, they provide a 90-day remediation period, after which details are disclosed (the deadline for vulnerabilities already being actively exploited is shorter). This practice once sparked controversy but has significantly accelerated vendor patching speeds and is now widely emulated.
- CVE: Publicly disclosed vulnerabilities receive a CVE ID (e.g., CVE-2024-3094), which the entire industry uses to track and communicate about the same vulnerability.
- Bug Bounty Platforms: Platforms like HackerOne and Bugcrowd help enterprises operate bounty programs; in the cryptocurrency field, there are specialized platforms like Immunefi, where bounties for a single high-severity vulnerability can reach millions or even tens of millions of dollars. For example, in 2022, Wormhole paid a $10 million bounty to a researcher who reported a critical vulnerability.
- Cryptocurrency "White Hat Negotiations": After many theft incidents, project teams leave messages on-chain for attackers, proposing: "Return most of the funds, keep the rest as a bounty, and we won't pursue legal action." After Poly Network was robbed of approximately $610 million in 2021, the attacker eventually returned almost all the funds. This practice operates in a legal and ethical gray area but is widely adopted given the reality that funds are often difficult to recover.
- Safe Harbor: To encourage white hats to "rescue" funds during an ongoing attack (transferring funds to a secure address before the attacker does), the crypto security community (such as SEAL) launched the White Hat Safe Harbor framework in 2024, pre-defining rules, bounty ratios, and legal protections for white hat rescues.
Layer 3: Principles and Engineering
3.1 security.txt
A text file placed in a fixed location on a website (RFC 9116, 2022) that tells researchers how to contact you:
# https://example.com/.well-known/security.txt
Contact: mailto:[email protected]
Expires: 2027-12-31T23:59:59Z
Encryption: https://example.com/pgp-key.txt
Policy: https://example.com/security-policy
Preferred-Languages: zh, en
It takes only a few minutes to set up. Without it, researchers who find vulnerabilities might be unable to find anyone to report to, leaving them to contact customer service or simply give up.
3.2 A minimal disclosure policy
| Content | Description |
|---|---|
| Scope | Which domains, applications, or contracts are in scope; which are not (e.g., third-party services) |
| How to report | Email, forms; what information is expected (reproduction steps, impact) |
| Response commitment | How long until receipt is acknowledged, how long until a preliminary assessment is provided |
| Research rules | Do not access others' data, do not impact service availability, do not perform social engineering, prioritize testnets |
| Safe Harbor Statement | Promise not to take legal action against good-faith researchers who follow the rules |
| Disclosure timing | How long after a fix can it be disclosed; whether credit will be given |
3.3 Designing a Bug Bounty Program
| Key points | Description |
|---|---|
| Pricing by impact | For vulnerabilities that can directly steal funds, the bounty should be linked to potential losses (a common practice in crypto is "a certain percentage of affected funds, with a cap") |
| Competitive bounties | If black market prices are much higher than the bounty, you won't retain researchers |
| Fast processing | Delays, lowballing, or non-responsiveness will drive researchers toward public disclosure |
| Clear severity standards | Reduces disputes |
| Don't rely solely on bounties | Bounties are a supplement to audits and testing, not a replacement (see Smart Contract Auditing and Formal Verification) |
3.4 After receiving a report
- Quickly acknowledge receipt and thank the researcher;
- Reproduce and assess the severity;
- If it is high-severity, treat it as an incident (see Incident Response and Post-mortems): immediate suspension of certain features may be required;
- Fix, verify, and deploy;
- Coordinate the disclosure timing with the researcher, provide credit, and pay the bounty;
- Release an announcement or security advisory, and apply for a CVE if necessary.
3.5 Reminders for researchers
- Test only within the explicitly authorized scope; if there is a bounty program, follow its rules;
- Do not exceed the minimum scope required to prove the vulnerability (proving you can read one piece of data is enough; do not download the entire database);
- Keep records of communication;
- If you cannot contact the vendor, you can relay the message through coordination bodies like CERT.
Summary
| Layer | Key points |
|---|---|
| Principles | Notify privately first, provide a remediation period (commonly 90 days), then disclose upon expiration |
| Mechanisms | CVE IDs, bug bounty platforms, cryptocurrency white hat negotiations, and safe harbors |
| Minimum requirements | Publish a security.txt; write a disclosure policy that includes a safe harbor statement |
| Bounty design | Price by impact, be competitive, process quickly, and do not replace audits |