responsible-disclosure

name	responsible-disclosure
version	2.0.0
description	Ethical vulnerability reporting, coordinated disclosure, and bug bounty participation for AI systems
sasmp_version	1.3.0
bonded_agent	01-red-team-commander
bond_type	PRIMARY_BOND
input_schema	{"type":"object","required":["disclosure_type"],"properties":{"disclosure_type":{"type":"string","enum":["coordinated","full","bug_bounty","private"]},"vulnerability":{"type":"object","properties":{"severity":{"type":"string","enum":["critical","high","medium","low"]},"category":{"type":"string"},"vendor":{"type":"string"}}},"timeline":{"type":"object","properties":{"discovery_date":{"type":"string"},"disclosure_deadline":{"type":"integer","default":90}}}}}
output_schema	{"type":"object","properties":{"disclosure_plan":{"type":"object"},"report_template":{"type":"string"},"timeline":{"type":"object"},"legal_considerations":{"type":"array"}}}
owasp_llm_2025	["LLM01","LLM02","LLM03","LLM04","LLM05","LLM06","LLM07","LLM08","LLM09","LLM10"]
nist_ai_rmf	["Govern","Manage"]

Responsible Disclosure

Practice ethical vulnerability reporting through coordinated disclosure and bug bounty programs.

Quick Reference

Skill:       responsible-disclosure
Agent:       01-red-team-lead
OWASP:       Full LLM Top 10 Coverage
NIST:        Govern, Manage
Use Case:    Ethical vulnerability reporting

Disclosure Framework

┌────────────────────────────────────────────────────────────────────┐
│                    RESPONSIBLE DISCLOSURE LIFECYCLE                 │
├────────────────────────────────────────────────────────────────────┤
│                                                                     │
│  [Discovery] → [Verification] → [Documentation] → [Initial Contact]│
│       ↓              ↓               ↓                  ↓          │
│  Find issue     Reproduce       Full report      Contact vendor    │
│                 in isolation    with POC         security team     │
│                                                                     │
│  [Coordination] → [Remediation] → [Verification] → [Disclosure]    │
│       ↓              ↓               ↓                  ↓          │
│  Work with      Vendor         Confirm fix      Publish after      │
│  vendor         develops fix   is effective     patch available    │
│                                                                     │
└────────────────────────────────────────────────────────────────────┘

Disclosure Types

Coordinated Disclosure (Recommended)

class CoordinatedDisclosure:
    """Standard coordinated disclosure process."""

    STANDARD_TIMELINE = 90  # days

    def __init__(self, vulnerability: Vulnerability):
        self.vulnerability = vulnerability
        .timeline = ._calculate_timeline()
        .communications = []

     () -> DisclosureTimeline:
        
        base_days = .STANDARD_TIMELINE

        
         .vulnerability.severity == :
            
             DisclosureTimeline(
                initial_report=,
                vendor_response=,
                fix_development=,
                patch_release=,
                public_disclosure=
            )
         .vulnerability.severity == :
             DisclosureTimeline(
                initial_report=,
                vendor_response=,
                fix_development=,
                patch_release=,
                public_disclosure=
            )
        :
             DisclosureTimeline(
                initial_report=,
                vendor_response=,
                fix_development=,
                patch_release=,
                public_disclosure=
            )

     ():
        
        
        ._send_initial_report()

        
        ._coordinate_with_vendor()

        
        ._verify_patch()

        
        ._public_disclosure()