1. Introduction

Coordinated Vulnerability Disclosure (CVD) is a legal and institutional framework through which cybersecurity researchers, ethical hackers, technology companies, software developers and government authorities identify, report, investigate and remediate security vulnerabilities in computer systems.

A vulnerability is a weakness in software, hardware, networks, applications or digital infrastructure that may allow unauthorized access, data theft, surveillance, manipulation or disruption of services.

The central objective of coordinated vulnerability disclosure is to balance three competing interests:

Public security: Ensuring that vulnerabilities are corrected before malicious actors exploit them.

Research freedom: Protecting legitimate cybersecurity researchers who discover and responsibly report vulnerabilities.

Organizational accountability: Requiring technology providers and infrastructure operators to investigate and remediate reported vulnerabilities within reasonable periods.

Two important legal concepts govern this framework:

Disclosure timelines: The period within which researchers, organizations and relevant authorities should communicate, investigate, coordinate and resolve vulnerabilities.

Safe harbor: Legal protection, subject to defined conditions, for good-faith security research conducted within authorized boundaries.

CVD is therefore not simply a technical procedure. It raises questions of criminal liability, privacy, intellectual property, contractual restrictions, public interest, responsible disclosure and proportionality of enforcement.

2. Meaning and Legal Nature of Coordinated Vulnerability Disclosure

Coordinated vulnerability disclosure refers to a structured process in which a researcher privately reports a discovered vulnerability to the affected organization, allowing the organization sufficient time to investigate and develop a security correction before wider public disclosure.

The process generally involves:

Discovery of a security weakness.

Preparation of technical evidence.

Confidential notification to the affected organization.

Acknowledgment and assessment of the report.

Risk classification and prioritization.

Development and testing of a patch or mitigation.

Coordination with relevant authorities where necessary.

Public disclosure after an appropriate period.

CVD differs from immediate public disclosure because it attempts to prevent attackers from exploiting an unpatched vulnerability.

It also differs from unauthorized intrusion. Discovering a vulnerability does not automatically authorize a researcher to access additional systems, extract personal information, bypass security controls or interfere with operations.

Its legal character depends on the researcher's authorization, applicable legislation, the nature of the testing and the conduct undertaken.

3. Legal Framework Governing Disclosure Timelines

Disclosure timelines establish procedural expectations for both researchers and organizations.

There is no universally applicable statutory deadline requiring every vulnerability to be disclosed after exactly 90 days. Different policies, regulatory regimes and contractual arrangements establish different periods.

A. Initial reporting period

The researcher should notify the affected organization as soon as reasonably practicable after validating the vulnerability.

A responsible report should ordinarily contain:

A description of the vulnerability.

Affected product or system.

Reproduction steps.

Potential security consequences.

Available technical evidence.

Suggested mitigation, where possible.

The report should avoid unnecessary disclosure of confidential information or personal data.

B. Acknowledgment period

Organizations should acknowledge receipt within a predefined period, often five to seven business days under an institutional disclosure policy.

An acknowledgment should provide a tracking reference and a communication channel.

C. Assessment period

The organization should determine:

Whether the vulnerability is genuine.

Whether exploitation is technically feasible.

Whether sensitive information is exposed.

Whether critical infrastructure is affected.

Whether immediate mitigation is necessary.

D. Remediation period

The organization should establish a remediation schedule based on the severity of the vulnerability.

A critical vulnerability affecting essential services may require immediate containment, whereas a low-risk issue may reasonably require a longer development cycle.

E. Public disclosure period

A 90-day coordinated disclosure period is a widely recognized policy benchmark in cybersecurity practice, particularly in vulnerability disclosure programs.

However, it is not a universal statutory limitation period.

Extensions may be justified where:

A complex patch requires additional testing.

Multiple vendors are affected.

Critical infrastructure is involved.

Premature disclosure would create substantial public danger.

An effective mitigation has not yet been developed.

Extensions should be reasoned, time-limited and communicated to the researcher.

4. Indian Legal Framework

India provides an important example of a developing vulnerability-disclosure framework through CERT-In.

A. Information Technology Act, 2000

The principal provisions relevant to vulnerability research include:

Important distinction: Good-faith security research is not automatically exempt from Sections 43 or 66. The authorization, scope of testing, nature of access and statutory elements of the alleged offence must be examined independently.

B. CERT-In Responsible Vulnerability Disclosure and Coordination Policy

India's CERT-In has established a Responsible Vulnerability Disclosure and Coordination Policy (RVDCP).

The policy provides a formal channel for researchers to report vulnerabilities and for CERT-In to coordinate with affected vendors and other stakeholders.

Its important requirements include:

The vulnerability should be reproducible on the latest or supported version of the product.

It should not already be known.

CERT-In examines and validates the report.

Following validation, CERT-In coordinates with the vendor, researcher and other relevant stakeholders.

Public vulnerability notes or advisories may be issued after remediation or at an appropriate time determined through coordination.

120-day benchmark

CERT-In endeavours to resolve a coordinated vulnerability disclosure issue within 120 days from the date of initial contact with the vendor.

The period may change when the vulnerability is actively exploited, exceptionally serious, reported by multiple sources or subject to agreement among the relevant parties. CERT-In may also close an unresolved case or consider public disclosure in specified circumstances.

CERT-IN+1

This is particularly important because the Indian framework does not simply adopt the international 90-day benchmark. It has its own institutional coordination period.

C. Section 70B and CERT-In's statutory authority

Section 70B recognizes CERT-In as India's national agency for performing specified cybersecurity functions.

These include:

Collection and dissemination of cybersecurity information.

Cybersecurity incident response.

Coordination of incident-response activities.

Issuing vulnerability notes and security advisories.

Recommending information-security practices.

The CERT-In Rules, 2013 also provide a framework for handling and protecting information received during its functions.

The CERT-In Directions of 28 April 2022 additionally establish incident-reporting and information-security requirements for specified entities. These incident-reporting obligations should not be confused with the separate 120-day vulnerability coordination policy.

UNIDIR Cyber Policy Portal Database+1

D. Is there an Indian statutory safe harbor?

India does not have a general statutory safe-harbor provision that automatically immunizes all good-faith vulnerability researchers from civil or criminal liability.

Participation in a disclosure program may provide evidence of authorization and good faith, but its protection depends on the actual scope of the program and applicable law.

Consequently, an Indian organization should expressly define authorized targets, permitted testing techniques, prohibited activities and the procedure for handling accidentally accessed personal information.

5. Safe Harbor: Meaning and Legal Foundation

Safe harbor is a legal protection mechanism designed to prevent legitimate cybersecurity researchers from being subjected to unnecessary legal proceedings merely because they identify and report security weaknesses within an authorized research framework.

It attempts to distinguish legitimate security research from malicious hacking.

A properly drafted safe-harbor policy may provide that an organization:

Will not pursue civil claims for activities within the authorized research scope.

Will not initiate criminal complaints solely because of qualifying good-faith research.

Will treat compliant testing as authorized for the purposes of its own systems.

Will not impose contractual penalties for activities expressly permitted by the policy.

Will cooperate with researchers who report vulnerabilities responsibly.

However, a private organization's promise cannot override criminal legislation, bind government prosecutors or courts, or authorize interference with third-party systems.

A. Essential elements of safe harbor

1. Good-faith intention

The researcher must act with the genuine purpose of identifying and reporting a security weakness rather than exploiting it for personal benefit.

2. Defined authorization

The organization must identify which websites, applications, APIs, networks and systems are included in the research program.

3. Limited access

Researchers should access only the information reasonably necessary to establish the vulnerability.

4. Non-destructive testing

Testing should not involve intentional service disruption, destruction of data, ransomware deployment or unauthorized modification of production systems.

5. Responsible reporting

The vulnerability must be communicated through the designated reporting channel.

6. Confidentiality

Researchers should protect sensitive information and refrain from publishing exploit details prematurely.

7. No extortion

A researcher must not threaten disclosure unless paid, demand unauthorized financial benefits or use a discovered vulnerability to obtain leverage.

B. Legal limitations of safe harbor

Safe harbor does not necessarily protect:

Unauthorized access to third-party systems.

Theft or commercial exploitation of personal data.

Destructive cyber operations.

Denial-of-service attacks.

Persistence mechanisms installed without authorization.

Disclosure of confidential information outside permitted conditions.

Conduct exceeding the scope of an approved bug-bounty program.

The distinction is between authorized investigation and unauthorized exploitation, not simply between an ethical hacker and a malicious hacker.

6. International Legal Framework

A. European Union: NIS2 Directive

Article 12 of the NIS2 Directive (Directive (EU) 2022/2555) establishes a coordinated vulnerability disclosure framework.

It requires Member States to designate a CSIRT coordinator that acts as a trusted intermediary between researchers and affected manufacturers or service providers.

The coordinator's functions include:

Identifying affected entities.

Assisting vulnerability reporters.

Negotiating disclosure timelines.

Managing vulnerabilities affecting multiple entities.

Supporting anonymous vulnerability reporting.

The Directive also encourages Member States to address researchers' exposure to criminal and civil liability and consider non-prosecution guidance and civil-liability exemptions under national law.

This is a significant development because it recognizes that cybersecurity research requires not only technical coordination but also legal protection.

EUR-Lex+1

B. United States: Vulnerability disclosure and safe harbor

The United States has developed vulnerability disclosure policies through federal agencies and cybersecurity institutions.

For example, the General Services Administration's Vulnerability Disclosure Policy provides defined reporting requirements, a 90-day confidentiality expectation and specific legal-protection language.

However, its protection is limited to activity complying with the policy and applicable law.

GSA

The legal debate is particularly relevant to the Computer Fraud and Abuse Act (CFAA), which governs specified unauthorized computer access.

C. International 90-day benchmark

Several institutions adopt a 90-day period as a practical disclosure standard.

For example, the US Department of Health and Human Services asks researchers to maintain confidentiality for 90 calendar days following acknowledgment of a report. ENISA also applies a 90-day minimum confidentiality period in its responsible disclosure process.

HHS.gov+1

These are institutional policies, not a universal international statute.

7. Important Case Laws and Judicial Principles

There is an important distinction between cases directly deciding coordinated vulnerability disclosure and cases establishing legal principles applicable to cybersecurity research.

As of November 2026, the leading judgments discussed below do not establish a comprehensive judicially created safe harbor for vulnerability researchers. They provide principles concerning unauthorized access, privacy, digital rights and the limits of computer-crime legislation.

A. Indian case laws

1. Justice K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1

Supreme Court of India – Nine-judge Bench

Facts and legal question:

The case concerned whether privacy constitutes a fundamental right under the Constitution of India.

Judgment:

The Supreme Court unanimously recognized privacy as a constitutionally protected fundamental right under Article 21 and other freedoms guaranteed by Part III.

The Court recognized informational privacy and the dangers created by modern information technologies.

Relevance to vulnerability disclosure:

This judgment has significant implications for security researchers.

For example, a researcher discovering a vulnerability in a government database may inadvertently encounter personal information, biometric records or confidential communications.

The privacy principles require that such information be handled with care.

A vulnerability disclosure process should therefore:

Minimize access to personal information.

Avoid unnecessary copying of sensitive data.

Maintain confidentiality.

Ensure proportionate security testing.

Protect individuals whose information may be exposed.

Legal principle: Cybersecurity research must be balanced against the constitutional protection of informational privacy.

2. Shreya Singhal v. Union of India, (2015) 5 SCC 1

Facts:

The constitutional validity of Section 66A of the Information Technology Act, 2000, was challenged.

The provision criminalized certain forms of online communication.

Judgment:

The Supreme Court struck down Section 66A as unconstitutional because of its excessive and vague restrictions on freedom of speech and expression.

Relevance to CVD:

The judgment is relevant to public vulnerability disclosures, technical advisories, cybersecurity research publications and discussions concerning software vulnerabilities.

A disclosure policy should not become an instrument for suppressing legitimate technical communication merely because it exposes organizational security weaknesses.

However, the judgment does not provide immunity from otherwise applicable provisions governing unauthorized access, privacy violations or data theft.

Legal principle: Restrictions affecting digital communication must satisfy constitutional standards and cannot rest on vague or overbroad legal prohibitions.

B. United States case laws

3. Van Buren v. United States, 593 U.S. 374 (2021)

United States Supreme Court

Facts:

A police officer used his authorized credentials to access a law-enforcement database for an improper personal purpose.

The question was whether misuse of information obtained through authorized access amounted to exceeding authorized access under the Computer Fraud and Abuse Act.

Judgment:

The Supreme Court adopted a narrow, so-called gates-up-or-down interpretation of the CFAA's exceeding-authorized-access provision.

It distinguished between accessing information in areas of a computer system that a person is entitled to access and accessing areas that are off limits.

Relevance to CVD:

The decision helps distinguish unauthorized access from misuse of information obtained through otherwise authorized access.

For vulnerability research, the distinction is important:

Access to an authorized testing environment is different from access to restricted systems.

A researcher's authorization should be defined by the system owner's permission.

The existence of a legitimate research objective does not automatically authorize access to every system or database.

Legal principle: Computer-access liability requires careful consideration of the scope of authorization and the statutory definition of prohibited access.

LII / Legal Information Institute+1

4. United States v. Nosal, 844 F.3d 1024 (9th Cir. 2016)

Facts:

Former employees continued accessing their former employer's confidential database using the credentials of a current employee after their own access had been revoked.

Judgment:

The Ninth Circuit held that access after affirmative revocation of permission constituted access without authorization under the CFAA.

Relevance to CVD:

The decision illustrates why vulnerability disclosure programs must clearly define authorization.

A researcher cannot assume that an earlier permission, employment relationship or existing account provides unlimited authority to continue testing.

When an organization withdraws permission, the researcher must respect that withdrawal.

Legal principle: Express revocation of computer-access authorization can create criminal-law consequences when access continues.

Ninth Circuit Court of Appeals+1

5. hiQ Labs, Inc. v. LinkedIn Corp. , 31 F.4th 1180 (9th Cir. 2022)

Facts:

hiQ Labs collected publicly accessible information from LinkedIn profiles using automated software. LinkedIn attempted to prevent the activity.

Judgment:

The Ninth Circuit held that accessing information available to the general public did not, on the facts before it, amount to access without authorization under the CFAA.

The decision addressed a specific legal question about publicly accessible information and did not eliminate other possible legal claims.

Relevance to CVD:

The judgment illustrates the importance of distinguishing publicly accessible information from restricted databases and authenticated systems.

It also demonstrates that the legal consequences of automated testing depend on the nature of the system, access restrictions and applicable causes of action.

Legal principle: Public accessibility and technical access restrictions are relevant when determining whether conduct constitutes unauthorized computer access.

Ninth Circuit Court of Appeals+1

C. Comparative judicial significance

These cases are persuasive comparative material for Indian legal analysis, not binding interpretations of India's Information Technology Act.

8. Legal Structure of a Coordinated Disclosure Timeline

An effective CVD framework should distinguish between the researcher's reporting obligations and the organization's remediation obligations.

The following is an illustrative institutional model, not a universal statutory timetable.

The actual deadline should depend on the severity, affected systems, available mitigation and potential harm.

Disclosure timeline diagram

Day 0 – Vulnerability discovery and reporting

Researcher submits a confidential report.

Day 7 – Acknowledgment

Organization confirms receipt and provides a reference number.

Day 15 – Technical validation

Security team verifies the reported weakness.

Day 30 – Remediation strategy

Risk classification, containment and patch planning.

Day 60–90 – Remediation

Patch development, security testing and mitigation.

Day 90–120 – Coordinated publication

Public advisory, researcher credit and disclosure of the resolved vulnerability.

Illustrative model. India's CERT-In policy uses its own 120-day coordination benchmark measured from initial vendor contact.

9. Multi-Party Coordinated Vulnerability Disclosure

Modern digital infrastructure often depends on multiple software providers, cloud service providers, hardware manufacturers and third-party libraries.

A single vulnerability may therefore affect hundreds of organizations.

For example, a vulnerability in a widely used authentication library could affect:

Banking applications.

Government portals.

Healthcare platforms.

Cloud infrastructure.

Telecommunications networks.

Enterprise software.

In such circumstances, disclosure to only one vendor may be insufficient.

A multi-party coordination framework should establish:

Identification of all materially affected vendors.

Appointment of a lead coordinating organization.

Confidential sharing of technical findings.

Agreement on common remediation deadlines.

Coordination of security advisories.

Protection of researcher identity where appropriate.

Simultaneous or appropriately staggered publication.

Article 12 of the NIS2 Directive expressly recognizes the need to coordinate vulnerabilities affecting multiple entities.

EUR-Lex+1

10. Legal Consequences of Delayed Disclosure

Delay may create legal problems for both researchers and organizations.

A. Delay by researchers

Unreasonable delay in reporting a critical vulnerability may allow malicious actors to exploit the weakness.

Premature publication of exploit details may also increase the risk to affected users.

The appropriate response depends on the public-interest implications and the existence of effective mitigation.

B. Delay by organizations

An organization that ignores a credible vulnerability report may expose users to avoidable risks.

Depending on the facts and applicable legislation, this may raise issues involving:

Data protection obligations.

Contractual duties.

Sector-specific cybersecurity requirements.

Consumer protection.

Negligence.

Regulatory compliance.

In India, the Digital Personal Data Protection Act, 2023, and applicable rules and commencement notifications must also be considered when a vulnerability creates risks to digital personal data.

A vulnerability report alone does not automatically establish a personal-data breach. The actual incident and applicable statutory obligations must be assessed.

C. Failure to provide safe harbor

If an organization invites security researchers to test its systems but provides unclear authorization boundaries, it creates legal uncertainty.

Researchers may face allegations despite believing their actions were permitted.

Organizations should therefore publish precise vulnerability disclosure policies and establish clear reporting procedures.

11. Safe Harbor and Contractual Protection Mechanisms

Organizations should incorporate safe-harbor provisions into their vulnerability disclosure policies.

A legally effective policy should address the following matters.

A. Authorization clause

The organization should expressly authorize specified security testing on identified systems, subject to published conditions.

B. Good-faith research clause

Researchers acting within the permitted scope should receive appropriate protection against contractual claims by the organization.

C. Non-prosecution commitment

The organization may state that it will not initiate or recommend legal action solely for research conducted in accordance with its policy.

This commitment cannot guarantee immunity from prosecution or bind independent public authorities.

D. Confidentiality clause

Researchers should agree to protect confidential technical information until the coordinated disclosure process reaches an appropriate stage.

E. Personal-data protection clause

Researchers must avoid accessing, retaining or publishing personal information beyond what is reasonably necessary for demonstrating the vulnerability.

F. Non-retaliation principle

Organizations should not retaliate against researchers merely because they identify genuine security weaknesses and report them in good faith.

12. Relationship with Intellectual Property and Data Protection Law

CVD can also create disputes under intellectual property and data protection legislation.

Copyright law: Security testing may involve examining software, source code or executable components. The legality of copying, modifying or reverse-engineering software depends on applicable copyright legislation, contractual permission and relevant exceptions.

Trade secrets: A vulnerability report may reveal confidential algorithms, source code or proprietary technical information. Disclosure should be limited to information necessary to explain the vulnerability.

Data protection: Researchers should avoid collecting personal data unnecessarily. Organizations should ensure that vulnerability reports and associated evidence are handled securely.

Contract law: Bug-bounty agreements and disclosure policies can establish the contractual boundaries of permitted research, including deadlines, rewards, confidentiality and dispute resolution.

In India, the relevant statutory framework includes the Copyright Act, 1957, the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023, subject to the applicable commencement and implementation provisions.

13. Constitutional and Human Rights Dimensions

CVD raises several constitutional questions.

A. Right to privacy – Article 21

The constitutional right to privacy requires appropriate safeguards when researchers encounter personal information during vulnerability testing.

B. Freedom of expression – Article 19(1)(a)

Technical publications, security advisories and research papers may constitute protected expression.

However, freedom of expression does not automatically authorize unauthorized access or unrestricted disclosure of confidential information.

C. Reasonable restrictions – Article 19(2)

Restrictions on public disclosure may be justified where they satisfy applicable constitutional requirements.

D. Rule of law

Organizations and government agencies should establish transparent procedures rather than relying on arbitrary decisions about whether researchers will face legal action.

E. Proportionality

Legal consequences should be assessed in light of the nature of the research, the scope of authorization, the actual harm and the relevant statutory requirements.

14. Institutional Responsibilities

15. Major Legal Challenges

Several unresolved issues remain in the development of CVD law.

1. Absence of comprehensive statutory immunity

Many jurisdictions still rely on institutional policies rather than comprehensive statutory protections.

2. Unclear authorization

A researcher may not know whether a particular testing technique falls within the scope of an organization's permission.

3. Conflicting disclosure deadlines

Researchers, vendors and government agencies may disagree about when disclosure should take place.

4. Cross-border jurisdiction

A vulnerability discovered in one country may affect servers, customers and service providers in several other countries.

5. Critical infrastructure

Premature disclosure of vulnerabilities in electricity grids, banking networks, hospitals and telecommunications systems may create serious public-safety concerns.

6. Researcher retaliation

Researchers may face legal notices, account termination or contractual threats despite attempting to follow disclosure procedures.

7. Third-party software dependencies

A vulnerability may affect several vendors, making it difficult to coordinate a single remediation deadline.

8. Artificial intelligence and automated vulnerability discovery

AI-assisted security tools can identify vulnerabilities at scale. Legal frameworks must distinguish validated research from automated activity that generates false positives, disrupts systems or accesses information beyond authorization.

16. Recommendations for Legal and Regulatory Reform in India

India could strengthen its existing framework through the following measures:

1. Statutory safe harbor: Introduce narrowly defined legal protections for good-faith security research conducted within authorized boundaries.

2. Standardized disclosure policies: Encourage public and private organizations to adopt common vulnerability disclosure procedures.

3. Clear authorization rules: Require organizations to identify permitted systems, techniques and testing limitations.

4. Time-bound responses: Establish acknowledgment, validation and remediation targets based on vulnerability severity.

5. Independent dispute resolution: Provide a mechanism for resolving disagreements between researchers and vendors.

6. Researcher confidentiality: Strengthen protection of researcher identities and submitted vulnerability reports.

7. Critical infrastructure safeguards: Establish special procedures for vulnerabilities affecting essential services.

8. Non-retaliation guidelines: Encourage appropriate non-prosecution and non-litigation commitments for compliant research, subject to applicable law.

9. International coordination: Improve cooperation between CERT-In, foreign CSIRTs and international cybersecurity organizations.

10. Public accountability: Require organizations to document remediation decisions and explain substantial delays.

17. Conclusion

Coordinated Vulnerability Disclosure Timelines and Safe Harbor represent an important development in contemporary cybersecurity law.

The framework attempts to reconcile the interests of security researchers, software manufacturers, government authorities and the general public.

Disclosure timelines ensure that vulnerabilities are investigated and corrected within a reasonable period. Safe-harbor mechanisms encourage researchers to identify and report security weaknesses without unnecessary fear of legal retaliation.

India's CERT-In Responsible Vulnerability Disclosure and Coordination Policy provides an institutional foundation through its 120-day resolution benchmark. However, the absence of comprehensive statutory safe harbor remains an important legal limitation.

The principles emerging from Puttaswamy, Shreya Singhal, Van Buren, Nosal and hiQ Labs help explain the relationship between privacy, freedom of expression, authorization and cybersecurity research.

Ultimately, an effective legal framework must protect legitimate research without granting unrestricted permission to access computer systems. It must also ensure that organizations cannot indefinitely delay remediation of serious vulnerabilities.

The fundamental legal proposition is that cybersecurity research should be encouraged through clearly defined authorization, proportionate legal protection, transparent disclosure deadlines and enforceable accountability.

18. Important Legal Sources and References

Primary institutional references:

CERT-In – Responsible Vulnerability Disclosure and Coordination Policy

CERT-In – CVE Numbering Authority

EU NIS2 Directive – Article 12

US General Services Administration – Vulnerability Disclosure Policy

Puttaswamy v. Union of India – Judgment

Shreya Singhal v. Union of India – Judgment

Van Buren v. United States – Judgment

Academic note: The case laws are relevant judicial authorities and comparative precedents; they should not be represented as judgments directly establishing a CVD safe-harbor doctrine. The precise applicability of Indian statutory provisions and subsequent amendments should be checked against the current official legal texts.