# go.disclose.io

> Everything disclose.io makes, in one place. Open source, vendor-neutral, free. This file indexes every live disclose.io property, open-source repository, and community channel for both humans and AI assistants.

disclose.io is a vendor-neutral, open-source project that standardizes safe harbor for good-faith security research and vulnerability disclosure. Canonical home: https://disclose.io/

lookup.disclose.io publishes its own machine-readable guide at https://lookup.disclose.io/llms.txt.

## Questions
### What is disclose.io?
A vendor-neutral, open-source project that standardizes safe harbor for good-faith security research and vulnerability disclosure. Everything it makes is free.

### How do I find the security contact for a domain, IP, repo, or package?
Use lookup.disclose.io. It turns any asset into the right security contact through a web UI, a JSON API, and a hosted MCP server at lookup.disclose.io/mcp. The dio-lookup CLI, the Burp, ZAP and Caido plugins, the Nmap script, and the Nuclei templates all call the same service.

### Where can I check whether an organization has a VDP or bug bounty program?
directory.disclose.io is the open system of record for every known VDP and bug bounty program, graded against the disclose.io maturity model (Level 0 to Level 5).

### How do I write a vulnerability disclosure policy with safe harbor?
Start from the disclose.io Framework & Terms, the canonical CC0 safe-harbor and disclosure language, or use policymaker.disclose.io to generate a VDP policy, a safe-harbor clause, a security.txt, and a DNS Security TXT record.

### How do I report a vulnerability in disclose.io itself?
Email security@disclose.io, or follow the policy at disclose.io/security.

## Start Here
- [disclose.io](https://disclose.io): The project home: the framework, the docs, and the mission.
- [directory.disclose.io](https://directory.disclose.io): The open system of record for every known VDP and bug bounty program, graded against the maturity model.
- [lookup.disclose.io](https://lookup.disclose.io): Turn any asset (domain, IP, repo, package, container, app) into the right security contact. Web UI, JSON API, and a hosted MCP server.
- [Framework & Terms](https://disclose.io/framework/): The canonical, lawyer-reviewed, CC0 safe-harbor and vulnerability-disclosure language.
- [Maturity Model](https://disclose.io/framework/maturity/): The vulnerability disclosure maturity model: what Level 0 through Level 5 look like, and how programs are graded.
- [Docs](https://disclose.io/docs/): Learn how vulnerability disclosure, safe harbor, and the disclose.io resources work.

## Tools
- [policymaker.disclose.io](https://policymaker.disclose.io): Generate a VDP policy, a safe-harbor clause, a security.txt, and a DNS Security TXT record.
- [vault.disclose.io](https://vault.disclose.io): A dead-man's switch for disclosure. Commit a finding under a timelock that cannot be bypassed.
- [dnssecuritytxt.org](https://dnssecuritytxt.org): A standard for publishing your security contact at the DNS layer.

## Data
- [state.disclose.io](https://state.disclose.io): The maturity pyramid, plus Top 100 disclosure scoreboards for the US, AU and UK.
- [Platforms](https://disclose.io/platforms/): A community-powered collection of every known bug bounty, VDP, and crowdsourced security platform.
- [Threats](https://disclose.io/threats/): An ongoing archive of legal threats made against researchers acting in good faith.

## Community
- [community.disclose.io](https://community.disclose.io): The open forum, where finders, builders, CERTs, and facilitators actually talk.
- [Our own VDP](https://disclose.io/security/): disclose.io practises what it publishes. Report an issue in our own stack here.

## Reading
- [blog.disclose.io](https://blog.disclose.io): Running With Scissors: commentary, plus the weekly PolicyPulse signal.
- [Disclosure timeline](https://disclose.io/history/): Major events in the standardization of vulnerability reporting and disclosure.

## Install
- [dio-lookup (npm)](https://www.npmjs.com/package/dio-lookup): Pipe internet assets into lookup.disclose.io and get security contacts back as JSONL. Built for recon pipelines.
- [MCP server (hosted)](https://lookup.disclose.io/mcp): Point any MCP client at this endpoint and your agent can resolve security contacts. Listed in the official MCP registry as io.github.disclose/lookup-disclose-io.
- [Caido plugin](https://github.com/disclose/caido-lookup): Right-click any host in Caido to resolve its security-disclosure contact. Listed in the Caido Community Store as Disclosure Lookup.
- [Burp Suite extension](https://github.com/disclose/burp-lookup/releases/latest): Right-click any host in Burp Suite to find its security-disclosure contact. Load the .jar from the latest release; not yet in the BApp Store.
- [ZAP add-on](https://github.com/disclose/zap-lookup/releases/latest): Right-click any host in ZAP to find its security-disclosure contact. Install the .zap file from the latest release; marketplace listing pending.
- [Nmap NSE script](https://github.com/disclose/nmap-lookup): Adds ownership and disclosure-route context to Nmap host results, via lookup.disclose.io. It never probes the target service.
- [Browser extension](https://github.com/disclose/chrome-extension-v2/releases/latest): See a site's VDP, safe harbor, and disclosure maturity as you browse, live from directory.disclose.io. Load the release zip unpacked; Chrome Web Store listing pending.
- [Nuclei templates](https://github.com/disclose/nuclei-templates): Enrich every host Nuclei scans with the security contact responsible for it.

## Contact
- [hello@disclose.io](mailto:hello@disclose.io): General enquiries, ideas, and new project proposals.
- [security@disclose.io](mailto:security@disclose.io): Report a vulnerability in disclose.io's own infrastructure.

## Open Source
- [bug-bounty-platforms](https://github.com/disclose/bug-bounty-platforms): A community-powered collection of all known bug bounty platforms, vulnerability disclosure platforms, and crowdsourced security platforms currently active on the Internet.
- [research-threats](https://github.com/disclose/research-threats): Collection of legal threats against good faith Security Researchers; vulnerability disclosure gone wrong. A continuation of work started by @attritionorg
- [dioterms](https://github.com/disclose/dioterms): Open-source vulnerability disclosure policy templates.
- [dnssecuritytxt](https://github.com/disclose/dnssecuritytxt): A standard allowing organizations to nominate security contact points and policies via DNS TXT records.
- [diosts](https://github.com/disclose/diosts): A Go scraper that validates security.txt files and outputs them in the disclose.io JSON format.
- [website](https://github.com/disclose/website): The current website at https://disclose.io.
- [policymaker](https://github.com/disclose/policymaker): A free, open-source, multi-lingual, template-based VDP policy, safe harbor clause, securitytxt, and DNS Security TXT generator.
- [dioseal](https://github.com/disclose/dioseal): The Disclose.io Status best practice seal.
- [caido-lookup](https://github.com/disclose/caido-lookup): Caido plugin: look up security-disclosure contacts for any host via lookup.disclose.io
- [dio-lookup](https://github.com/disclose/dio-lookup): Pipe internet assets to lookup.disclose.io and get security-disclosure contacts as JSONL, built for recon pipelines.
- [burp-lookup](https://github.com/disclose/burp-lookup): Burp Suite extension: look up security-disclosure contacts for any host via lookup.disclose.io
- [chrome-extension-v2](https://github.com/disclose/chrome-extension-v2): disclose.io browser extension, surfaces VDP / safe harbor / disclosure maturity for the current site, polled live from directory.disclose.io.
- [nuclei-templates](https://github.com/disclose/nuclei-templates): disclose.io Nuclei enrichment templates, resolve the security-disclosure contact for every host you scan (via lookup.disclose.io)
- [history.disclose.io](https://github.com/disclose/history.disclose.io): The Archeology of Safe Harbor, a sourced history of the disclose.io terms · https://history.disclose.io
- [nmap-lookup](https://github.com/disclose/nmap-lookup): Nmap NSE script: enrich scan targets with ownership and responsible disclosure routes via lookup.disclose.io
- [state-of-disclosure](https://github.com/disclose/state-of-disclosure): A living one-page snapshot of the disclose.io ecosystem, ~27,500 organisations mapped against the maturity model, the threats archive, the platforms registry, and the full disclose.io stack.
- [vuln-disclosure-history](https://github.com/disclose/vuln-disclosure-history): History of vulnerability disclosure
- [zap-lookup](https://github.com/disclose/zap-lookup): OWASP ZAP add-on: right-click a host to find its security-disclosure contact via lookup.disclose.io (the open-source-proxy sibling of the Burp & Caido plugins)

## Connect
- [GitHub](https://github.com/disclose): @disclose
- [X](https://x.com/disclose_io): @disclose_io
- [Bluesky](https://bsky.app/profile/disclose.io): @disclose.io
- [Mastodon](https://infosec.exchange/@disclose): @disclose@infosec.exchange
- [LinkedIn](https://www.linkedin.com/company/disclose-io): disclose-io
- [YouTube](https://www.youtube.com/@discloseio): @discloseio
- [Threads](https://www.threads.com/@disclose.io): @disclose.io
- [Instagram](https://www.instagram.com/disclose.io/): @disclose.io