{
  "slug": "disclosure-retest",
  "title": "Coordinated Disclosure & Retesting",
  "phase": "Reporting",
  "description": "Navigate coordinated disclosure timelines, communicate professionally with triage teams, handle duplicates and escalation, and rigorously retest fixes for bypasses and regressions.",
  "difficulty": "low",
  "tags": [
    "reporting",
    "disclosure",
    "retesting",
    "triage",
    "responsible-disclosure"
  ],
  "tools": [
    "hackerone",
    "bugcrowd",
    "curl",
    "burpsuite",
    "markdown"
  ],
  "steps": [
    {
      "id": "disclosure-01",
      "title": "Understand disclosure timelines and programme SLAs",
      "description": "Read the programme policy and set expectations around response, triage, resolution, and disclosure windows before you submit.",
      "notes": "Coordinated disclosure means agreeing a timeline with the vendor rather than going public unilaterally. Note the programme's stated SLAs for first response and triage, and record your submission timestamp so you can reference it if a deadline slips."
    },
    {
      "id": "disclosure-02",
      "title": "Communicate professionally with triage teams",
      "description": "Write clear, reproducible reports and keep correspondence factual, patient, and free of pressure tactics.",
      "notes": "Lead with a one-line impact summary, then give exact reproduction steps, a minimal PoC, and the affected asset. Assume the triager is overloaded and unfamiliar with your target. Avoid demanding a bounty amount or a severity rating up front; let the evidence make the case."
    },
    {
      "id": "disclosure-03",
      "title": "Handle duplicates, informatives, and escalation",
      "description": "Respond constructively to duplicate or informative closures and use mediation only when genuinely warranted.",
      "notes": "If a report is closed as duplicate, politely ask for confirmation that the root cause matches. For an informative or N/A closure you disagree with, add new evidence of impact rather than repeating your argument. Escalate to platform mediation only after a good-faith exchange has stalled."
    },
    {
      "id": "disclosure-04",
      "title": "Verify and retest the deployed fix",
      "description": "Once the programme marks the issue resolved, re-run your original PoC against the patched endpoint to confirm the vulnerability is actually closed.",
      "commands": [
        "curl -si 'https://target.com/api/users/1002/profile' -H 'Authorization: Bearer <token>' | head -n 1"
      ],
      "notes": "Do not take the resolved status at face value. Reproduce with the original payload first, and only close the loop once you have observed the patched behaviour yourself."
    },
    {
      "id": "disclosure-05",
      "title": "Hunt for regressions, variants, and bypasses",
      "description": "After confirming the direct fix, probe for filter bypasses, alternate endpoints, and reintroductions of the same flaw elsewhere.",
      "commands": [
        "curl -si 'https://target.com/api/users/%31%30%30%32/profile' -H 'Authorization: Bearer <token>' | head -n 1",
        "curl -si 'https://target.com/api/v1/users/1002/profile' -H 'Authorization: Bearer <token>' | head -n 1"
      ],
      "notes": "Fixes are frequently incomplete, blocking one payload while missing an encoded or case-varied equivalent. A trivially bypassable patch is itself a reportable finding, so document the bypass clearly and reopen the original report where the platform allows it."
    },
    {
      "id": "disclosure-06",
      "title": "Practise safe public disclosure",
      "description": "Only publish a write-up after the fix is confirmed and the programme has granted permission, with sensitive details redacted.",
      "notes": "Wait for explicit disclosure permission or the policy's automatic disclosure window before publishing. Redact customer data, internal hostnames, credentials, and anything that could enable copycat attacks. When in doubt, ask the programme to review your draft before it goes live."
    }
  ],
  "references": [
    "https://www.hackerone.com/disclosure-guidelines",
    "https://docs.bugcrowd.com/researchers/reporting-managing-submissions/disclosure/",
    "https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability_Disclosure_Cheat_Sheet.html",
    "https://www.first.org/global/sigs/vulnerability-coordination/multiparty/guidelines-v1.1",
    "https://www.cisa.gov/coordinated-vulnerability-disclosure-process"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-07-05"
}