Definition
Plain language
Telling the people who make a piece of software about a security hole so they can fix it.
As stated in the literature
The coordinated process of reporting a discovered flaw to a vendor or maintainer, typically with an embargo period before public release of details or proof-of-concept code.
Also called: disclosure, coordinated disclosure, responsible disclosure
Why it matters: The embargo window is what keeps flaw-finding from immediately becoming free ammunition for attackers, and it strains badly if discoveries start arriving faster than fixes can ship.
For example, a researcher who finds a flaw in a popular chat app tells the company privately, waits ninety days while a fix is rolled out, and only then publishes the details.
Heard on the show
“… The hierarchical agents, the adversarial review loops, the progressive disclosure, the treatment of failures as first-class data, the hard programmatic constraints on declaring …”Episode 029 — Why Forty-Eight Percent on FrontierMath Isn't the Real Story in DeepMind's New Math Paper