Disclosure Guidelines

Cenzic Software Vulnerability Disclosure Guidelines - 2007

Once a vulnerability is identified, Cenzic will inform the software vendor affected by the vulnerability. If the vendor doesn't communicate back within 10 days of notification, Cenzic may choose to disclose the vulnerability to MITRE, FIRST, CSI, Vuln-Watch and other associations. If the vendor communicates back with Cenzic within 10 days and requests an extension to fix the vulnerability before Cenzic discloses the vulnerability publicly, Cenzic will work with the vendor to make reasonable accommodations. After working with the vendor, unless no communication has occurred from the vendor, and 5 days after notifying the appropriate associations and services, Cenzic will send out a press release on the vulnerability.