Framework — Maturity (diostatus)
The disclose.io Maturity Model — a six-level self-assessment for vulnerability disclosure program readiness.
diostatus is a six-level self-assessment describing how prepared an organisation is to receive and handle external vulnerability reports.
The progression in one line
Findable → Communicating → Not hostile → Explicitly safe → Accountable.
Each level builds on the previous, creating a clear progression path for organisations to improve their vulnerability disclosure practices.
Summary
| Level | Name | Key Signal | Researcher Protection |
|---|---|---|---|
| 0 | Not Present | No contact, no policy | None |
| 1 | Contact Only | security.txt / intake method exists | None (but reachable) |
| 2 | Basic VDP | Public policy + channel | None (but documented) |
| 3 | Partial Safe Harbor | Won’t pursue legal action | Partial — report safely |
| 4 | Full Safe Harbor | Explicitly authorises testing + law exemptions | Full — test safely |
| 5 | Full Safe Harbor + CVD | Level 4 + proactive disclosure timeline | Full + accountability |
See the individual level pages for plain-English definitions of each stage and how to progress between them.
Level 0 — Not Present
No findable contact, no policy, no intake method.
Level 1 — Contact Only
security.txt published; a researcher can reach someone. No policy yet.
Level 2 — Basic VDP
Public policy document and a real submission channel. No legal protection.
Level 3 — Partial Safe Harbor
A commitment not to pursue legal action. Report safely; test uncertainly.
Level 4 — Full Safe Harbor
Explicit testing authorisation and carve-outs from CFAA / DMCA / TOS.
Level 5 — Full Safe Harbor + CVD
Level 4 plus a public coordinated-disclosure timeline. Accountable.
