← WA Computer Science ATAR Unit 2

Responsible disclosure of vulnerabilities

Privately reporting a vulnerability you found to its owner and giving them time to fix it before telling the public, so attackers can't exploit it.

Part of: WA Computer Science ATAR Year 11 — Cyber Security — Module 148

Understanding Responsible disclosure of vulnerabilities in WA Computer Science ATAR Unit 2

What it does: A vulnerability report is sent directly to the owner's security contact, not posted publicly, so the owner can fix the flaw first. Details are made public only after a fix is ready or the agreed time has passed, which is the final step of responsible disclosure. The delay gives the owner time to patch the vulnerability. Telling the public too early lets attackers exploit it. Reporting does not fix the flaw. Keeping the details private while the owner patches it stops attackers from using it in the meantime. Bug bounty programs give finders a safe, official way to report flaws, and often pay a reward.

Common mistakes: After privately reporting the bug, you must wait for the owner to fix it. Telling the public first lets attackers exploit the bug. Line 3 should be wait_for_patch(owner). Responsible disclosure means reporting the vulnerability to its owner so it can be fixed. Keeping it to yourself fixes nothing. Line 2 should be report_to_owner(bug).

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Responsible disclosure of vulnerabilities to a class →

This module's key terms are also in a printable crossword (Modules 125–266) and word search (Modules 28–266).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
You find a flaw in a school's online portal. What is the responsible disclosure approach?
Post it on social media so everyone knows straight awayPrivately report it to the school and give them time to fix it
Matches
post_on_social_media(vulnerability_details) # before the owner is told
↓
The flaw is made public before the owner knows, so attackers can exploit it before any fix exists. It should be reported privately to the owner first.
Applying
Meanings
Term
responsible disclosure
Meaning
Privately reporting a vulnerability you found to its owner and giving them time to fix it before telling the public, so attackers can't exploit it.
Practice
To: security@example.com
Testing
Gaps
sendPrivately(, report)
Check Answer
Spots
2report_privately(owner)
3tell_public(found)

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Gulper Eel' badge — Deep Streak, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. You find a flaw in a school's online portal. What is the responsible disclosure approach?
A. Privately report it to the school and give them time to fix it ✓
B. Post it on social media so everyone knows straight away
Responsible disclosure means telling the owner privately first, so the flaw can be fixed before attackers learn about it.
2. Which statement about responsible disclosure is correct?
A. The public is told the moment the flaw is found
B. The public is told only after the owner has had time to fix the flaw ✓
The delay gives the owner time to patch the vulnerability. Telling the public too early lets attackers exploit it.
3. Why does responsible disclosure keep users safer?
A. It makes the flaw disappear as soon as it is reported
B. Attackers can't exploit the flaw while a fix is being built ✓
Reporting does not fix the flaw. Keeping the details private while the owner patches it stops attackers from using it in the meantime.
4. A researcher publishes the full details of an unpatched flaw online before telling the owner. Which term describes this?
A. Public disclosure before a fix, which is not responsible ✓
B. Responsible disclosure
Publishing details before the owner can fix the flaw puts users at risk. Responsible disclosure keeps the details private until a fix is ready.
5. What is a bug bounty program?
A. A company rewards people who report vulnerabilities to it ✓
B. A company fines people who find vulnerabilities in its software
Bug bounty programs give finders a safe, official way to report flaws, and often pay a reward.

Match the Pairs

responsible disclosure → Privately reporting a vulnerability you found to its owner and giving them time to fix it before telling the public
bug bounty program → An organisation's offer to pay or reward people who find and privately report vulnerabilities in its systems
A vulnerability report goes privately to the owner and describes the flaw so it can be fixed → To: security@school.edu.au Subject: Vulnerability report - login page
Public disclosure is only done after the owner has had time to fix the flaw → if (patch_released or deadline_passed): publish_details()
post_on_social_media(vulnerability_details) # before the owner is told → The flaw is made public before the owner knows, so attackers can exploit it before any fix exists. It should be reported privately to the owner first.
report_to_owner(flaw); publish_details(flaw) # same day → The owner is told but given no time to fix the flaw before it is published. A reasonable time to fix it must pass before going public.

Key Term

responsible disclosure
Privately reporting a vulnerability you found to its owner and giving them time to fix it before telling the public, so attackers can't exploit it.

Fill in the Blanks

1. vendor ← "ShopSafe" report ← "XSS in the comment box" sendPrivately(vendor, report)
Hint: Type the variable that holds the owner of the vulnerable software, who should receive the vulnerability report privately.
2. sendPrivately(vendor, report) WHILE NOT fixReleased wait(1)
Hint: Type the keyword that reverses the condition, so the loop keeps waiting until the owner has released a fix.
3. IF reportIsValid THEN payBounty(finder) END IF
Hint: Type the function name that rewards the finder when a bug bounty program accepts a valid vulnerability report.
4. IF daysPassed > deadline THEN publish(report) END IF
Hint: Type the function name for public disclosure, which is only used after the owner's time limit has run out.
5. IF fixReleased OR daysPassed > deadline THEN publish(report) END IF
Hint: Type the logical operator meaning that either one of the two conditions being true is enough to allow public release.

Spot the Error

Question 1
A found ← find_bug(app)
B report_privately(owner)
C tell_public(found)
D publish_advisory(patched)
Line C — After privately reporting the bug, you must wait for the owner to fix it. Telling the public first lets attackers exploit the bug. Line 3 should be wait_for_patch(owner).
Question 2
A bug ← find_bug(app)
B keep_bug_to_self()
C wait_for_patch(owner)
Line B — Responsible disclosure means reporting the vulnerability to its owner so it can be fixed. Keeping it to yourself fixes nothing. Line 2 should be report_to_owner(bug).
Question 3
A found ← login_bug(site)
B proof ← download_all_users()
C report_privately(owner)
Line B — Ethical finders only use their own test account as proof. Downloading other users' data breaks privacy and may be illegal. Line 2 should be proof ← test_own_account().
Question 4
A target ← any_server_online
B found ← test(target)
C submit_report(found)
Line A — Bug bounty programs only allow testing of systems listed in their scope. Testing any server online is unauthorised. Line 1 should pick a target from program.scope.
Question 5
A found ← test(in_scope_site)
B threaten(owner, leak_bug)
C reward ← owner.decide()
Line B — Threatening to leak the bug unless you are paid is extortion, not responsible disclosure. You submit a bounty report and let the owner decide the reward. Line 2 should be submit(bounty_report).

Student with a class code? Join your class →