Microsoft's MSRC just invoked the Digital Crimes Unit against the researcher behind six Windows zero-days, and the pioneers of coordinated disclosure are publicly disputing the framework Microsoft is invoking. Policy Pulse Issue 17: blog.disclose.io/policy-pulse...

Peter G. Neumann, 1932-2026. Forty-one years moderating the ACM RISKS Forum. Five decades arguing that secure systems need hardware foundations and formal methods. The conscience of computer security. This week's Policy Pulse leads with his tribute. blog.disclose.io/policy-pulse...

Hackers on the Hill — June 16, US Capitol. Researchers and Hill staff, same room. Real 1:1 office briefings. No vendors. No shilling. If you build or break for a living and want policy to reflect that — show up. hackersonthehill.org/us-2026 #infosec #cyberpolicy

Policy Pulse Issue #14: UK and Ireland line up behind Project Glasswing as Mythos forces a new disclosure reality. CyberUp ranks the UK behind US, France, and Australia on researcher protections. https://blog.disclose.io/policy-pulse-issue-14-week-of-may-9-2026/

Policy Pulse #9: OWASP's Agentic AI Top 10 redefines what VDP programs need to handle. Plus: OpenAI safety bounty, Langflow exploited in 20hrs, GSA's first AI acquisition clause. https://blog.disclose.io/policy-pulse-issue-9-week-of-april-6-2026/

The CVE program is "saved" by a mystery contract with a mystery number. Transparency? Not so much. Plus: lookup.disclose.io beta is live, EU CRA hits 6 months, exploited vulns up 105%. Policy Pulse #8: https://blog.disclose.io/policy-pulse-issue-8-week-of-march-29-2026/ #CVE #PolicyPulse

Policy Pulse Issue #7 is out. This week: NIST SSDF 1.2 deadline March 31, CIRCIA stalled by DHS shutdown, a CVE weaponized in 20 hours, NIST AI agent identity paper, and SRLDF board expansion. https://blog.disclose.io/policy-pulse-issue-7-week-of-march-22-2026/

Joining the Security Research Legal Defense Fund Board

--profile disclose --text Australia mandates VDPs for ALL smart devices — March 4. Every IoT manufacturer must accept vuln reports with 48hr SLAs. No safe harbor for researchers though. Policy Pulse #4: https://blog.disclose.io/policy-pulse-issue-4-week-of-february-22-2026/

Policy Pulse #3 is out. CISA BOD 26-02 targets unsupported edge devices, MITRE CVE contract 30 days from the cliff, UK statutory defence for researchers advancing, plus new data on threats facing researchers. https://blog.disclose.io/policy-pulse-issue-3-week-of-february-15-2026/

Wrote about this week in VDP policy—the federal contractor mandate moving through Congress could reshape the ecosystem. If you follow government supply chain policy or AI governance: https://blog.disclose.io/policy-pulse-issue-2-week-of-february-8-2026/

Bose open-sources its SoundTouch home theater smart speakers ahead of end-of-life arstechnica.com/gadgets/2026...

Platforms.disclose.io just added 25 NEW bug bounty and VDP platforms! - @disclose_io Community Forum m.disclose.io/4p3Zu3p

m.disclose.io/2WIvxxz just added 25 NEW bug bounty and VDP platforms! - @disclose_io Community Forum

Hey! We just updated platforms.disclose.io with 25+ new bug bounty & VDP platforms! 🎯 • Web3: @Cantinaxyz @CodeHawks @CertiK @xyz_remedy • Russia: @standoff365 @bizone • Asia: @IssueHunt (Japan), @patchday_io (Korea), Butian (China) Check out the full list: platforms.disclose.io #BugBounty #VDP

Need Help – Company Shut Down Bug Bounty Program After Fixing My 10 Reported Bugs Without Reward - Hacker Connect - @disclose_io Community Forum

Possibly uncovering a domain spoofing scheme targeting major real estate brands — looking for guidance - Hacker Connect - @disclose_io Community Forum m.disclose.io/3XXk7Cc

Risky Bulletin: Russian bill would require researchers to report bugs to the FSB 👀 m.disclose.io/4oTTbz1

Ugh… It’s 2025 and vendors still don’t understand the Streisand-effect. cc: @disclose_io (threats.disclose.io) YouTuber with nearly 4M subscribers sued by lock company after he breaks into lock with just a can www.uniladtech.com/social-media...

Research on legal risk experiences — seeking interviewees - Hacker Connect - @disclose_io Community Forum m.disclose.io/4lkPpgy

The disclose.io Community Forum is Back—Here’s How to Dive In substack.com/home/post/p-...

👀 👀 👀 Published yesterday, ENISA’s latest guidelines outline best practices for vulnerability management and disclosure in IT products under the EU Common Criteria (EUCC).

Policymaker: The free, open-source vulnerability disclosure program (VDP) policy, security.txt, and DNS Security TXT generator - Part of the @disclose_io Project.

dnssecuritytxt - A standard allowing organizations to nominate security contact points and policies via DNS TXT records - Part of the @disclose_io Project

threats.disclose.io: An ongoing collection of legal threats made against Security Researchers: over-reactions, demands, and cease & desist letters against good faith research - A part of the @disclose_io Project https://m.disclose.io/3bfIfLT