Responsible disclosure of vulnerabilities

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. You find a flaw in a school's online portal. What is the responsible disclosure approach?

A Privately report it to the school and give them time to fix it

B Post it on social media so everyone knows straight away

2. Which statement about responsible disclosure is correct?

A The public is told the moment the flaw is found

B The public is told only after the owner has had time to fix the flaw

3. Why does responsible disclosure keep users safer?

A It makes the flaw disappear as soon as it is reported

B Attackers can't exploit the flaw while a fix is being built

4. A researcher publishes the full details of an unpatched flaw online before telling the owner. Which term describes this?

A Public disclosure before a fix, which is not responsible

B Responsible disclosure

5. What is a bug bounty program?

A A company rewards people who report vulnerabilities to it

B A company fines people who find vulnerabilities in its software

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1responsible disclosure		AThe owner is told but given no time to fix the flaw before it is published. A reasonable time to fix it must pass before going public.
2bug bounty program		BTo: security@school.edu.au Subject: Vulnerability report - login page
3A vulnerability report goes privately to the owner and describes the flaw so it can be fixed		CThe flaw is made public before the owner knows, so attackers can exploit it before any fix exists. It should be reported privately to the owner first.
4Public disclosure is only done after the owner has had time to fix the flaw		Dif (patch_released or deadline_passed): publish_details()
5post_on_social_media(vulnerability_details) # before the owner is told		EAn organisation's offer to pay or reward people who find and privately report vulnerabilities in its systems
6report_to_owner(flaw); publish_details(flaw) # same day		FPrivately reporting a vulnerability you found to its owner and giving them time to fix it before telling the public

Definitions

responsible disclosure

Fill in the Blanks

Complete each line of code by filling in the missing parts.

vendor ← "ShopSafe" report ← "XSS in the comment box" sendPrivately(______, report)

sendPrivately(vendor, report) WHILE ___ fixReleased wait(1)

IF reportIsValid THEN _________(finder) END IF

IF daysPassed > deadline THEN _______(report) END IF

IF fixReleased __ daysPassed > deadline THEN publish(report) END IF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A found ← find_bug(app)

B report_privately(owner)

C tell_public(found)

D publish_advisory(patched)

Question 2

A bug ← find_bug(app)

B keep_bug_to_self()

C wait_for_patch(owner)

Question 3

A found ← login_bug(site)

B proof ← download_all_users()

C report_privately(owner)

Question 4

A target ← any_server_online

B found ← test(target)

C submit_report(found)

Question 5

A found ← test(in_scope_site)

B threaten(owner, leak_bug)

C reward ← owner.decide()

Answer Key

Responsible disclosure of vulnerabilities

Section A: Quick Questions

A — Privately report it to the school and give them time to fix it

B — The public is told only after the owner has had time to fix the flaw

B — Attackers can't exploit the flaw while a fix is being built

A — Public disclosure before a fix, which is not responsible

A — A company rewards people who report vulnerabilities to it

Section B: Match the Pairs

responsible disclosure → Privately reporting a vulnerability you found to its owner and giving them time to fix it before telling the public

bug bounty program → An organisation's offer to pay or reward people who find and privately report vulnerabilities in its systems

A vulnerability report goes privately to the owner and describes the flaw so it can be fixed → To: security@school.edu.au Subject: Vulnerability report - login page

Public disclosure is only done after the owner has had time to fix the flaw → if (patch_released or deadline_passed): publish_details()

post_on_social_media(vulnerability_details) # before the owner is told → The flaw is made public before the owner knows, so attackers can exploit it before any fix exists. It should be reported privately to the owner first.

report_to_owner(flaw); publish_details(flaw) # same day → The owner is told but given no time to fix the flaw before it is published. A reasonable time to fix it must pass before going public.

Section C: Definitions

responsible disclosure — Privately reporting a vulnerability you found to its owner and giving them time to fix it before telling the public, so attackers can't exploit it.

Section D: Fill in the Blanks

vendor ← "ShopSafe"
report ← "XSS in the comment box"
sendPrivately(vendor, report)

sendPrivately(vendor, report)
WHILE NOT fixReleased
    wait(1)

IF reportIsValid THEN
    payBounty(finder)
END IF

IF daysPassed > deadline THEN
    publish(report)
END IF

IF fixReleased OR daysPassed > deadline THEN
    publish(report)
END IF

Section E: Spot the Error

C — After privately reporting the bug, you must wait for the owner to fix it. Telling the public first lets attackers exploit the bug. Line 3 should be wait_for_patch(owner).

B — Responsible disclosure means reporting the vulnerability to its owner so it can be fixed. Keeping it to yourself fixes nothing. Line 2 should be report_to_owner(bug).

B — Ethical finders only use their own test account as proof. Downloading other users' data breaks privacy and may be illegal. Line 2 should be proof ← test_own_account().

A — Bug bounty programs only allow testing of systems listed in their scope. Testing any server online is unauthorised. Line 1 should pick a target from program.scope.

B — Threatening to leak the bug unless you are paid is extortion, not responsible disclosure. You submit a bounty report and let the owner decide the reward. Line 2 should be submit(bounty_report).