Coordinated Vulnerability Disclosure – Professional Playbook
The professional playbook for CVD: assess vulnerabilities with CVSS, EPSS and SSVC, navigate difficult situations, and build your own CVD process and bug-bounty policy. With real-world stories from Heartbleed and Log4Shell. Prerequisite: none. It helps to have already taken the free EACG starter course "CVD Basics" first — this course assumes a working understanding of the topic and builds on it.
What you'll learn
- Build a complete CVD process for your own organization
- Assess and prioritize vulnerabilities with CVSS v4, EPSS and SSVC
- Act correctly as a finder, vendor, or coordinator in difficult situations
- Coordinate multiparty CVD scenarios
- Set up a CVD policy and a security.txt
- Manage security researchers professionally — bounties, escalation, flooding
- Build a PSIRT and measure it with KPIs
Tags
securitycvdvulnerability-disclosurepsirtbug-bountycvssepssssvccsafeacg
Module 01 - Foundations Deepened ▶
- ▶ Introduction 0:49
- ▶ CVD in the Ecosystem: History & Standards 3:01
- ▶ Disclosure Philosophy & Standards 4:09
- ▶ Roles in Detail 4:30
- ▶ Core Principles of CVD 5:02
- ? Check: Foundations
Module 02 - Process in Detail ▶
- ▶ Process in Detail 0:10
- ▶ The CVD Process at a Glance: Six Phases 1:59
- ▶ Phase 1: Discovery 3:19
- ▶ Phase 2: Reporting Channels 3:51
- ▶ Writing a Report (I): Structure and Overview 1:41
- ▶ Writing a Report (II): Details and Reproduction 1:35
- ▶ Writing a Report (III): Remediation 0:44
- ▶ Phase 3: Triage 3:50
- ▶ Phase 4: Remediation and SLAs 3:30
- ▶ Downstream Communication 1:22
- ▶ Phases 5 & 6: Patch and Advisory 4:39
- ▶ After Publication 5:58
- ? Check: Process
Module 03 - Vulnerability Assessment ▶
- ▶ Vulnerability Assessment 0:12
- ▶ CVSS v3.1 in Detail 5:37
- ▶ CVSS v4.0 and Its Limits 5:02
- ▶ EPSS 2:25
- ▶ SSVC: the Tree, and Practice 3:32
- ▶ All Three Together 2:11
- ▶ The CVE System: Today and Tomorrow 6:11
- ? Check: Assessment — Foundations
- ? Check: Assessment — Match the Terms
- ? Check: Assessment — Complete the Process
Module 04 - Difficult Situations ▶
- ▶ Difficult Situations 0:11
- ▶ Why This Module? 2:59
- ▶ When the Vendor Goes Silent 2:03
- ▶ When Many Vendors Are Affected 2:11
- ▶ Who Reports to You 4:07
- ▶ Spotting and Defusing Friction 2:51
- ▶ The Policy as Foundation 1:58
- ▶ Managing Active Researchers 2:12
- ▶ When It Breaks: Embargo and the Law 3:45
- ▶ Two Wake-Up Calls from History 6:01
- ? Check: Difficult Situations
Module 05 - Building Capability ▶
- ▶ Building Capability 0:11
- ▶ From Theory to Your Own Capability 1:04
- ▶ The Written Foundations 4:48
- ▶ The Team Behind It 2:08
- ▶ Setting Up a Bug Bounty 4:14
- ▶ Is It Good? Measure It. 3:16
- ? Final Quiz
Module 06 - Closing ▶
- ▶ Closing 0:07
- ▶ Take-Home Messages and Resources 5:37
- ? Closing Challenge: 20 Questions in 20 Minutes