go.disclose.io
disclose.io

Everything we make, in one place.

Open source, vendor-neutral, free.

Connect

Start Here

disclose.io The project home: the framework, the docs, and the mission. disclose.io
directory.disclose.io The open system of record for every known VDP and bug bounty program, graded against the maturity model. directory.disclose.io
lookup.disclose.io Turn any asset (domain, IP, repo, package, container, app) into the right security contact. Web UI, JSON API, and a hosted MCP server. lookup.disclose.io
Framework & Terms The canonical, lawyer-reviewed, CC0 safe-harbor and vulnerability-disclosure language. disclose.io/framework
Maturity Model The vulnerability disclosure maturity model: what Level 0 through Level 5 look like, and how programs are graded. disclose.io/framework/maturity
Docs Learn how vulnerability disclosure, safe harbor, and the disclose.io resources work. disclose.io/docs

Tools

policymaker.disclose.io Generate a VDP policy, a safe-harbor clause, a security.txt, and a DNS Security TXT record. policymaker.disclose.io
vault.disclose.io alpha A dead-man's switch for disclosure. Commit a finding under a timelock that cannot be bypassed. vault.disclose.io
dnssecuritytxt.org A standard for publishing your security contact at the DNS layer. dnssecuritytxt.org

Data

state.disclose.io The maturity pyramid, plus Top 100 disclosure scoreboards for the US, AU and UK. state.disclose.io
Platforms A community-powered collection of every known bug bounty, VDP, and crowdsourced security platform. disclose.io/platforms
Threats An ongoing archive of legal threats made against researchers acting in good faith. disclose.io/threats

Community

community.disclose.io The open forum, where finders, builders, CERTs, and facilitators actually talk. community.disclose.io
Our own VDP disclose.io practises what it publishes. Report an issue in our own stack here. disclose.io/security

Reading

blog.disclose.io Running With Scissors: commentary, plus the weekly PolicyPulse signal. blog.disclose.io
Disclosure timeline Major events in the standardization of vulnerability reporting and disclosure. disclose.io/history

Install

dio-lookup (npm) Pipe internet assets into lookup.disclose.io and get security contacts back as JSONL. Built for recon pipelines. www.npmjs.com/package/dio-lookup
MCP server (hosted) Point any MCP client at this endpoint and your agent can resolve security contacts. Listed in the official MCP registry as io.github.disclose/lookup-disclose-io. lookup.disclose.io/mcp
Caido plugin Right-click any host in Caido to resolve its security-disclosure contact. Listed in the Caido Community Store as Disclosure Lookup. github.com/disclose/caido-lookup
Burp Suite extension manual install Right-click any host in Burp Suite to find its security-disclosure contact. Load the .jar from the latest release; not yet in the BApp Store. github.com/disclose/burp-lookup/releases/latest
ZAP add-on alpha Right-click any host in ZAP to find its security-disclosure contact. Install the .zap file from the latest release; marketplace listing pending. github.com/disclose/zap-lookup/releases/latest
Nmap NSE script Adds ownership and disclosure-route context to Nmap host results, via lookup.disclose.io. It never probes the target service. github.com/disclose/nmap-lookup
Browser extension preview See a site's VDP, safe harbor, and disclosure maturity as you browse, live from directory.disclose.io. Load the release zip unpacked; Chrome Web Store listing pending. github.com/disclose/chrome-extension-v2/releases/latest
Nuclei templates Enrich every host Nuclei scans with the security contact responsible for it. github.com/disclose/nuclei-templates

Contact

hello@disclose.io General enquiries, ideas, and new project proposals. mailto:hello@disclose.io
security@disclose.io Report a vulnerability in disclose.io's own infrastructure. mailto:security@disclose.io

Questions

What is disclose.io?
A vendor-neutral, open-source project that standardizes safe harbor for good-faith security research and vulnerability disclosure. Everything it makes is free.
How do I find the security contact for a domain, IP, repo, or package?
Use lookup.disclose.io. It turns any asset into the right security contact through a web UI, a JSON API, and a hosted MCP server at lookup.disclose.io/mcp. The dio-lookup CLI, the Burp, ZAP and Caido plugins, the Nmap script, and the Nuclei templates all call the same service.
Where can I check whether an organization has a VDP or bug bounty program?
directory.disclose.io is the open system of record for every known VDP and bug bounty program, graded against the disclose.io maturity model (Level 0 to Level 5).
How do I write a vulnerability disclosure policy with safe harbor?
Start from the disclose.io Framework & Terms, the canonical CC0 safe-harbor and disclosure language, or use policymaker.disclose.io to generate a VDP policy, a safe-harbor clause, a security.txt, and a DNS Security TXT record.
How do I report a vulnerability in disclose.io itself?
Email security@disclose.io, or follow the policy at disclose.io/security.

Open source

bug-bounty-platforms A community-powered collection of all known bug bounty platforms, vulnerability disclosure platforms, and crowdsourced security platforms currently active on the Internet.
research-threats Collection of legal threats against good faith Security Researchers; vulnerability disclosure gone wrong. A continuation of work started by @attritionorg
dioterms Open-source vulnerability disclosure policy templates.
dnssecuritytxt A standard allowing organizations to nominate security contact points and policies via DNS TXT records.
diosts A Go scraper that validates security.txt files and outputs them in the disclose.io JSON format.
website The current website at https://disclose.io.
policymaker A free, open-source, multi-lingual, template-based VDP policy, safe harbor clause, securitytxt, and DNS Security TXT generator.
dioseal The Disclose.io Status best practice seal.
caido-lookup Caido plugin: look up security-disclosure contacts for any host via lookup.disclose.io
dio-lookup Pipe internet assets to lookup.disclose.io and get security-disclosure contacts as JSONL, built for recon pipelines.
burp-lookup Burp Suite extension: look up security-disclosure contacts for any host via lookup.disclose.io
chrome-extension-v2 disclose.io browser extension, surfaces VDP / safe harbor / disclosure maturity for the current site, polled live from directory.disclose.io.
nuclei-templates disclose.io Nuclei enrichment templates, resolve the security-disclosure contact for every host you scan (via lookup.disclose.io)
history.disclose.io The Archeology of Safe Harbor, a sourced history of the disclose.io terms · https://history.disclose.io
nmap-lookup Nmap NSE script: enrich scan targets with ownership and responsible disclosure routes via lookup.disclose.io
state-of-disclosure A living one-page snapshot of the disclose.io ecosystem, ~27,500 organisations mapped against the maturity model, the threats archive, the platforms registry, and the full disclose.io stack.
vuln-disclosure-history History of vulnerability disclosure
zap-lookup OWASP ZAP add-on: right-click a host to find its security-disclosure contact via lookup.disclose.io (the open-source-proxy sibling of the Burp & Caido plugins)