| name | omv-disclose |
| description | Helps prepare responsible disclosure communications and timelines from an Evidence.v1 finding. Use when the user asks to contact a vendor, create initial/follow-up/deadline disclosure email templates, plan a 90-day timeline, record disclosure fields, or invokes `/omv-disclose`.
|
omv-disclose
Prepare local responsible disclosure material after a finding is report-ready.
Invocation
/omv-disclose <id>
/omv-disclose timeline <id> [--days N]
Workflow
- Read
.omv/findings/<id>.yaml using contracts/evidence.v1.yaml as the local schema reference.
- Identify vendor type: individual maintainer, company, foundation, or unknown.
- Generate three templates: initial contact, follow-up, and disclosure deadline reminder.
- Use
omv disclose timeline <id> for 90-day milestones or --days N for a custom window.
- Ask before writing Evidence.v1 disclosure fields.
Template Requirements
Include package name, affected versions, impact summary, reproduction summary, suggested coordination deadline, and contact metadata. Avoid exploit payload expansion beyond what the existing Evidence.v1 reproducer already states.
Local State
Submission bookkeeping belongs in .omv/submissions/<id>.yaml through omv submissions and follows contracts/submission.v1.yaml. Research notes belong in .omv/notes/<id>.md. Treat both as private local state until sanitized.
