go
.disclose.io
disclose.io
Everything we make, in one place.
Open source, vendor-neutral, free.
Connect
Start Here
disclose.io
The project home — the framework, the docs, and the mission.
disclose.io
directory.disclose.io
The open system of record for every known VDP and bug bounty program, graded against the maturity model.
directory.disclose.io
lookup.disclose.io
Turn any asset — domain, IP, repo, package, container, app — into the right security contact. Web UI, JSON API, and a hosted MCP server.
lookup.disclose.io
Framework & Terms
The canonical, lawyer-reviewed, CC0 safe-harbor and vulnerability-disclosure language.
disclose.io/framework
Maturity Model
The vulnerability disclosure maturity model: what Level 0 through Level 5 look like, and how programs are graded.
disclose.io/framework/maturity
Docs
Learn how vulnerability disclosure, safe harbor, and the disclose.io resources work.
disclose.io/docs
Tools
policymaker.disclose.io
Generate a VDP policy, a safe-harbor clause, a security.txt, and a DNS Security TXT record.
policymaker.disclose.io
vault.disclose.io
alpha
A dead-man's switch for disclosure. Commit a finding under a timelock that cannot be bypassed.
vault.disclose.io
dnssecuritytxt.org
A standard for publishing your security contact at the DNS layer.
dnssecuritytxt.org
Data
state.disclose.io
The maturity pyramid, plus Top 100 disclosure scoreboards for the US, AU and UK.
state.disclose.io
Platforms
A community-powered collection of every known bug bounty, VDP, and crowdsourced security platform.
disclose.io/platforms
Threats
An ongoing archive of legal threats made against researchers acting in good faith.
disclose.io/threats
Community
community.disclose.io
The open forum, where finders, builders, CERTs, and facilitators actually talk.
community.disclose.io
Our own VDP
disclose.io practises what it publishes. Report an issue in our own stack here.
disclose.io/security
Reading
blog.disclose.io
Running With Scissors — commentary, plus the weekly PolicyPulse signal.
blog.disclose.io
Disclosure timeline
Major events in the standardization of vulnerability reporting and disclosure.
disclose.io/history
Install
dio-lookup (npm)
Pipe internet assets into lookup.disclose.io and get security contacts back as JSONL. Built for recon pipelines.
www.npmjs.com/package/dio-lookup
MCP server (hosted)
Point any MCP client at this endpoint and your agent can resolve security contacts. Listed in the official MCP registry as io.github.disclose/lookup-disclose-io.
lookup.disclose.io/mcp
Caido plugin
Right-click any host in Caido to resolve its security-disclosure contact.
github.com/disclose/caido-lookup
Nuclei templates
Enrich every host Nuclei scans with the security contact responsible for it.
github.com/disclose/nuclei-templates
Contact
[email protected]
General enquiries, ideas, and new project proposals.
mailto:
[email protected]
[email protected]
Report a vulnerability in disclose.io's own infrastructure.
mailto:
[email protected]
Open source
bug-bounty-platforms
A community-powered collection of all known bug bounty platforms, vulnerability disclosure platforms, and crowdsourced security platforms currently active on the Internet.
research-threats
Collection of legal threats against good faith Security Researchers; vulnerability disclosure gone wrong. A continuation of work started by @attritionorg
dioterms
Open-source vulnerability disclosure policy templates.
dnssecuritytxt
A standard allowing organizations to nominate security contact points and policies via DNS TXT records.
diosts
A Go scraper that validates security.txt files and outputs them in the disclose.io JSON format.
website
The current website at https://disclose.io.
policymaker
A free, open-source, multi-lingual, template-based VDP policy, safe harbor clause, securitytxt, and DNS Security TXT generator.
dioseal
The Disclose.io Status best practice seal.
caido-lookup
Caido plugin: look up security-disclosure contacts for any host via lookup.disclose.io
burp-lookup
Burp Suite extension: look up security-disclosure contacts for any host via lookup.disclose.io
dio-lookup
Pipe internet assets to lookup.disclose.io and get security-disclosure contacts as JSONL — built for recon pipelines.
chrome-extension-v2
disclose.io browser extension — surfaces VDP / safe harbor / disclosure maturity for the current site, polled live from directory.disclose.io.
history.disclose.io
The Archeology of Safe Harbor — a sourced history of the disclose.io terms · https://history.disclose.io
nmap-lookup
Nmap NSE script: enrich scan targets with ownership and responsible disclosure routes via lookup.disclose.io
nuclei-templates
disclose.io Nuclei enrichment templates — resolve the security-disclosure contact for every host you scan (via lookup.disclose.io)
state-of-disclosure
A living one-page snapshot of the disclose.io ecosystem — ~27,500 organisations mapped against the maturity model, the threats archive, the platforms registry, and the full disclose.io stack.
vuln-disclosure-history
History of vulnerability disclosure
zap-lookup
OWASP ZAP add-on: right-click a host to find its security-disclosure contact via lookup.disclose.io (the open-source-proxy sibling of the Burp & Caido plugins)