Skip to content
Disclose Bot

Introduction

Disclose Bot helps organizations run Vulnerability Disclosure Programs (VDP): publish a disclosure policy, accept reports through a brief, and get discovered through a public directory.

How it fits together

Section titled “How it fits together”

Everything belongs to an organization. Within it, the three things you publish are:

  • Policies: your disclosure terms: who to contact, what’s in scope, your remediation timeline, and whether you offer safe harbor.
  • Briefs: intake pages that present your rules and a submission form. Reports that come in become vulnerabilities (vulns) in your inbox.
  • Directories: curated, public listings (for example on disclose.io) where your organization appears alongside its policy and a maturity rating.
Organization
 ├─ Policy   → published disclosure terms
 ├─ Brief    → intake page → Vuln (a submitted report)
 └─ Directory listing → public discovery + maturity rating

See Core concepts for the full model.

Where you work

Section titled “Where you work”

You set up and manage your program in the Disclose Bot app (app.disclosebot.io). Developers integrate through the Platform API (api.disclosebot.io).

Next steps

Section titled “Next steps”