disclose.io

Good-faith security researchers still get lawyers instead of thank-yous.

• Only 10 of the Fortune 100 offer researchers true legal safe harbor. ASX 100: six. FTSE 100: three. (state.disclose.io/top-100, June 2026 audit)
• Legal threats against researchers are still routine — disclose.io maintains the public database of them (research-threats).
• AI has multiplied both signal and noise — more findings, more reporters, more pressure on a disclosure model built for a smaller internet.

disclose.io — the front door

Mission: Be the front door that explains disclosure, safe harbor, and how to adopt best practice in minutes.

Vision: The default reference link anyone shares when asked "how do we do vulnerability disclosure right?"

→ routes to every property · home of research-threats & the platforms catalog

dioterms / dioseal

Mission: Provide readable, lawyer-approved policy language and a visible badge for doing it right.

Vision: Safe harbor made viral — the seal recognized like a padlock icon for disclosure maturity.

→ templates power policymaker · seals verified by diosts scans of the directory

policymaker.disclose.io

Mission: Let any organization generate a solid VDP policy, security.txt, and DNS Security TXT without a lawyer.

Vision: The industry-standard generator behind most new safe-harbor policies published on the web.

← dioterms templates · → newly published programs land in the directory

dnssecuritytxt

Mission: Standardize a DNS TXT record so security contact info is discoverable at the domain layer.

Vision: Adoption broad enough to reach IETF-track legitimacy and default tooling support.

→ a discovery source for lookup · generated by policymaker

directory.disclose.io / diodb

Mission: Maintain the open, accurate system of record for every VDP and bug bounty program.

Vision: The universally trusted open dataset every disclosure tool and platform builds on.

← policymaker & platform scrapers · → the data spine under lookup, audits, and downstream tools

lookup.disclose.io

Mission: Give researchers instant, free answers to "who owns this asset and how do I report to them safely?"

Vision: The canonical, always-free lookup layer wired into every recon tool, agent, and MCP client researchers use.

← diodb + dnssecuritytxt · → CLI, Caido, Burp, hosted MCP · usage telemetry feeds data quality back

vault.disclose.io

Mission: Cryptographically-enforced coordinated disclosure — time-locked submissions, vendor escalation, auto-publication when timelines lapse.

Vision: Deadline enforcement researchers and vendors can both trust, with no human in the loop to pressure.

← lookup finds the contact · → outcomes inform community norms and the blog

state.disclose.io + /top-100

Mission: Measure and publish, with zero hallucinations, how well the world's biggest companies actually handle disclosure.

Vision: The scoreboard boards and regulators cite, making safe-harbor maturity a competitive metric.

← audits run over the directory corpus · → public pressure drives adoption through policymaker & dioterms

disclose.io/threats

Mission: Maintain the canonical public archive of legal threats made against security researchers engaged in good-faith vulnerability disclosure.

Vision: The evidence base that makes the case for safe harbor undeniable — every incident recorded, sourced, and tracked to its outcome.

← incidents reported & verified via the community · → grounds the advocacy, the audits, and the legal-defense ecosystem

community.disclose.io

Mission: Give researchers and program owners a neutral home to ask, share, and shape disclosure practice.

Vision: The recognized cross-industry commons where disclosure norms are debated and settled.

← PolicyPulse signal & dates · → norms, contributions, and corrections flow back into standards and data

blog.disclose.io / PolicyPulse

Mission: Keep the ecosystem current on disclosure policy, legal shifts, and program changes every week.

Vision: The must-read policy signal for everyone working in or regulating vulnerability disclosure.

→ feeds the community & the shared calendar · ← disclosure outcomes from across the ecosystem

dates.disclose.io

Mission: Put every disclosure-relevant deadline, comment window, and event into one subscribable calendar.

Vision: The shared clock of the disclosure ecosystem — nobody misses a comment period again.

← curated weekly alongside PolicyPulse · → keeps the community synchronized

disclose.io, Inc. — the entity

Mission: Finish the Delaware nonprofit and secure 501(c)(3) so the initiative can take funding and endure.

Vision: A durable, funded, independent nonprofit steward for the disclosure commons.

→ the foundation layer: grants, contracts, insurance, and continuity for everything above