disclose.io

• Hackers and finders: You want to help but aren’t sure you’re welcome. We help you make safe decisions and reach the right people.
• Legal teams: Inviting hackers is still novel territory. We make it simple to give consensus-backed advice.
• Organizations: Vulnerabilities come with innovation. We help you say so, loudly and proudly.
• Security researchers: You’ve been waiting for the red carpet. We’ll help you find it.

Most anti-hacking laws pre-date the idea of hacking for good, or the “digital locksmiths” who increasingly shape modern digital safety.

Those laws get used to suppress good-faith research and limit bad publicity for vendors. The result is a “chilling effect” that silences the very people the Internet most needs to hear from. If hackers are the Internet’s immune system, the Internet still has an auto-immune problem.

Safe Harbor is language added to a policy that lets people acting in good faith, as the recipient defines it, report security issues without fear of legal repercussions.

disclose.io helps define, spread, and reward Safe Harbor and other disclosure best practices.

Glad you asked!

• Start or upgrade a vulnerability disclosure program (VDP) with best practices like Safe Harbor and clear disclosure timelines.
• Join the community and help finders connect with the security teams who need to hear from them.
• Help keep the directory of VDPs and bug bounty programs accurate and up to date.
• Improve the dioterms disclosure policy by raising an issue or adding a translation via a pull request.
• Volunteer as a maintainer on one of our projects.
• Suggest a new project.

disclose.io grew out of a merge of earlier standardization efforts by RainForest Puppy, Bugcrowd, CipherLaw, Dropbox, Dr. Amit Elazari, UC Berkeley, the National Telecommunications and Information Administration (NTIA), the US Department of Justice, and others.

disclose.io is incorporated as a Delaware nonprofit corporation. We’re completing the steps toward federal 501(c)(3) status, so contributions aren’t tax-deductible yet.

No. We’ve drawn on many legal opinions, but this isn’t legal advice. Consult your own counsel on whether the disclose.io terms fit your organization.