Framework: Maturity (diostatus)
The disclose.io Maturity Model, a six-level self-assessment for vulnerability disclosure program readiness.
diostatus is a six-level self-assessment describing how prepared an organisation is to receive and handle external vulnerability reports.
The progression in one line
Findable → Communicating → Not hostile → Explicitly safe → Accountable.
Each level builds on the previous, creating a clear progression path for organisations to improve their vulnerability disclosure practices.
Summary
| Level | Name | Key Signal | Researcher Protection |
|---|---|---|---|
| 0 | Not Present | No contact, no policy | None |
| 1 | Contact Only | security.txt / intake method exists | None (but reachable) |
| 2 | Basic VDP | Public policy + channel | None (but documented) |
| 3 | Partial Safe Harbor | Won’t pursue legal action | Partial, report safely |
| 4 | Full Safe Harbor | Explicitly authorises testing + law exemptions | Full, test safely |
| 5 | Full Safe Harbor + CVD | Level 4 + proactive disclosure timeline | Full + accountability |
See the individual level pages for plain-English definitions of each stage and how to progress between them.
Level 0: Not Present
No findable contact, no policy, no intake method.
Level 1: Contact Only
security.txt published; a researcher can reach someone. No policy yet.
Level 2: Basic VDP
Public policy document and a real submission channel. No legal protection.
Level 3: Partial Safe Harbor
A commitment not to pursue legal action. Report safely; test uncertainly.
Level 4: Full Safe Harbor
Explicit testing authorisation and carve-outs from CFAA / DMCA / TOS.
Level 5: Full Safe Harbor + CVD
Level 4 plus a public coordinated-disclosure timeline. Accountable.
