Coordinated Vulnerability
Disclosure Policy.

Program Charter And This Policy

The Trace0 Vulnerability Research and Engineering Team is the dedicated vulnerability research wing of Trace0 LLC. Its mission is to find serious, previously unknown vulnerabilities before adversaries do, drive them to a fix through coordinated disclosure, and turn the resulting knowledge into defensive value for the wider community. The team researches commercial software, open-source projects, cloud and hosted services, firmware, and the machine-learning and AI supply chain, and reports what it finds under this policy.

Vendors increasingly publish their own Coordinated Vulnerability Disclosure policy describing how they receive, triage, and remediate reports. This document is the counterpart from the other side of the exchange: it sets out how Trace0, as the finder, will act from the moment a vendor is contacted through to public disclosure. Publishing it in advance lets vendors plan against a known, consistent process and removes any ambiguity about Trace0's intentions.

Where a vendor operates its own CVD policy, or a bug-bounty or disclosure program, Trace0 follows that program's reporting rules together with this policy. The two are complementary: the vendor's policy governs how it handles a report internally, and this policy governs Trace0's own conduct and its disclosure timeline. If a vendor's rules and this policy genuinely conflict, for example on the timing of public disclosure, Trace0 raises the conflict with the vendor before acting and seeks a coordinated outcome in good faith.

Scope And Principles

This policy governs any security vulnerability discovered by the Trace0 VRE team, regardless of where it is found or how it is reported, including:

• Commercial and proprietary software, firmware, hardware, and cloud or hosted services;
• Open-source projects and their maintainers;
• Machine-learning and AI systems, model-loading paths, and their supply chains;
• Container images, packages, and other downstream redistribution of an affected component;
• Previously unknown issues found during original research, whether or not a formal disclosure or bug-bounty program exists.

Where a finding qualifies for a CVE, Trace0 pursues one. Coordinated disclosure, not full disclosure and not indefinite secrecy, is the default for every finding.

Definitions

The terms below carry specific meaning in this policy. They are defined once here and used consistently throughout.

Disclosure Deadlines

Day 0 is the date Trace0 first notifies the vendor or, where no vendor contact exists, the coordinating body identified under Reporting And Handling Process. All days are calendar days; each deadline falls at 23:59 UTC on its day. Where a deadline lands on a Saturday, Sunday, or a public holiday in Trace0's jurisdiction, it rolls to the next business day.

The timeline below applies the deadlines above to a typical finding. Every milestone is a fixed offset from Day 0, so both sides can plan against the same calendar from the outset.

Exceptions And Disputes

If the vulnerability is published by a third party, leaked, or otherwise becomes public before the deadline, or if credible evidence of active in-the-wild exploitation appears during the window, Trace0 may bring the disclosure date forward to protect users. Trace0 will give the vendor as much notice as the circumstances allow and will share what it knows so the vendor can respond quickly.

If the vendor disputes the finding, disagrees on severity, or decides not to fix it, Trace0 discusses the matter in good faith and will re-examine its own analysis on the evidence provided. The disclosure deadline still applies. Where disagreement remains at the deadline, Trace0 publishes and represents the vendor's position fairly alongside its own, including a documented "will not fix" status where that is the vendor's decision, so that defenders can make an informed judgement.

Beyond the standard 14-day grace period, Trace0 will consider a written request for a longer window in exceptional cases, such as a coordinated multi-vendor fix. These are handled case by case, in good faith, and agreed rather than granted automatically; they sit apart from the grace period set out above.

Reporting And Handling Process

Trace0 reports privately, before any public mention, through the vendor's designated security channel: a PSIRT address, a security.txt contact, a published disclosure or bug-bounty program, or a documented maintainer contact. The initial report contains enough for a vendor to triage and reproduce the issue:

• Affected product, component, and confirmed versions;
• A clear technical description and the security impact;
• A reproducible proof-of-concept or step-by-step reproduction;
• A severity assessment, typically CVSS v4.0, and relevant weakness classification (CWE);
• The Day 0 date and the deadline that follows from this policy.

Trace0 asks for acknowledgement of receipt within two to four business days, a triage outcome and a CVE request where applicable, and periodic status on the intended fix and advisory date. Trace0 responds to vendor questions within two business days, and sooner for anything that affects the timeline.

Where no security contact can be found, or a vendor does not respond, Trace0 engages a recognised coordinator, such as a national CSIRT or the CERT Coordination Center (CERT/CC), to relay the report and mediate a timeline. Where the affected vendor is not a CVE Numbering Authority or does not participate in the CVE Program, Trace0 requests a CVE identifier from the CNA of Last Resort operated by MITRE, so that the finding still receives an identifier for defenders to track. Where a project is unmaintained or abandoned, Trace0 proceeds through the same coordinator and CNA-of-last-resort route. In every such case Trace0 still publishes on the standard deadline; an unresponsive or absent vendor does not extend the deadline.

For findings in AI and ML systems (model-loading paths, model or dataset artefacts, and hosted inference), the responsible party is often a model host or platform operator rather than a traditional software vendor, and a conventional CVE home may not exist. Trace0 reports to the platform or host security contact, engages an ecosystem coordinator or the CNA of Last Resort where no CNA covers the component, and applies the same deadlines and conduct as for any other finding.

Publication And Coordination

On the disclosure date Trace0 publishes a technical advisory that may include the full write-up, a proof-of-concept, an independent-reproduction procedure, and a defender-facing detection and mitigation note. Trace0 is glad to review the wording with the vendor beforehand so the published material and the vendor advisory are consistent. Until the deadline, the report is held confidential under coordinated disclosure; the vendor is encouraged to share it with any party needed to triage, patch, or coordinate, including downstream consumers, without further consent from Trace0.

By default Trace0 publishes the full technical detail, including a working proof-of-concept, on the disclosure date, so that defenders can test for and detect the issue. Where the vendor asks Trace0 to hold back or delay a reliable, weaponised exploit, for example for a wormable or mass-exploitable flaw, Trace0 will do so under a mutual written agreement, while still publishing enough detail for defenders to protect themselves.

On confirmation of a finding, Trace0 asks the vendor, where it is a CNA for the affected product, to reserve a CVE ID under coordinated disclosure; a reserved ID is a placeholder that exposes no detail until publication. Trace0's preference is that such a vendor assigns the ID; otherwise Trace0 obtains one through the appropriate CNA or the CNA of Last Resort, and always shares it. Trace0 requests researcher credit by default and will adjust the wording, or remain unnamed, if the vendor's format requires it.

Where a finding affects more than one vendor, or is redistributed through a shared component or container image, Trace0 supports multi-party coordination and defers to the affected vendors on notifying downstream consumers, consistent with recognised multi-party disclosure practice.

Remediation Support And Collaboration

Trace0 treats a finding as only half-finished when it is reported; the goal is a shipped fix. To that end Trace0 offers the vendor the practical help below throughout the disclosure window. All of it is provided free of charge, with no conditions beyond coordinating in good faith.

Rules Of Engagement And Conduct

Trace0 tests only systems it is authorised to test or that are lawfully in scope of research. In the course of that work Trace0 does not:

• Disrupt or degrade services, including any form of denial-of-service or load testing;
• Access, copy, or retain third-party or customer data, or personal data, beyond the minimum needed to demonstrate a finding;
• Use social engineering, phishing, or physical intrusion against staff or facilities;
• Establish persistence, move laterally, or pivot beyond the system under test.

If sensitive or personal data is encountered incidentally, Trace0 stops, does not retain it, and reports the exposure to the vendor promptly.

Trace0 holds each report, proof-of-concept, and any data encountered in confidence, limits access to the researchers coordinating the finding, and stores it securely for the duration of the engagement. On request after disclosure, Trace0 will confirm deletion of vendor-supplied material and any incidentally captured data, retaining only what is needed for the public advisory and its own records.

Trace0 does not sell, auction, broker, or trade vulnerabilities, and does not provide them to offensive or gray-market buyers. Trace0 never withholds a disclosure, or offers to withhold one, in exchange for payment. Disclosure is coordinated with the vendor for remediation, not monetised.

Alignment With Recognised Standards

This policy is built on established coordinated-disclosure standards and on the vulnerability identifiers and scoring maintained by MITRE and FIRST. The table shows how each element aligns.

Contact