thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Coordinated Vulnerability Disclosure (CVD)

A disclosure model where a researcher privately reports a flaw and publication is delayed until the vendor can release a fix.

Definition

Under CVD, the finder, vendor and sometimes a coordinator such as CERT/CC agree on a timeline, commonly around 90 days, before public disclosure. It balances giving users protection with pressuring vendors to fix issues. It replaced the older term 'responsible disclosure'.

Example

Google Project Zero's policy gives vendors 90 days to patch before details are published.

Exam tip

Contrast CVD with full disclosure (immediate public release) and non-disclosure.

Related terms