diodb is a community-maintained, CC0-licensed dataset of every known VDP and bug bounty program and its safe-harbor status, built to support authorized disclosure work.
| Tool | disclose/diodb — open-source database of vulnerability disclosure and bug bounty programs with safe-harbor status |
| Category | Open dataset / vulnerability disclosure infrastructure |
| Primary Use | Looking up the correct disclosure contact, policy, and safe-harbor status of an organization before reporting a finding through program-list.json or directory.disclose.io |
| Safe Use | Intended for authorized security researchers, VDP operators, and defensive teams coordinating responsible disclosure under documented safe-harbor terms |
| Telemetry Note | Purely a data resource — it contacts no systems and generates no network telemetry; usage is invisible to targets |
diodb is not a scanner, proxy, or exploitation framework — it is something more foundational: an open, version-controlled dataset that maps the world's vulnerability disclosure programs (VDPs) and bug bounty initiatives to their contact channels, policy terms, and safe-harbor status. Maintained under the disclose organization as part of the broader disclose.io Project, the repository currently carries roughly 1,081 stars and is written primarily in Python, though the real artifact of value is a single structured file: program-list.json. The project positions itself as vendor-neutral infrastructure for disclosure, which is a polite way of saying it tries to solve the oldest problem in coordinated vulnerability disclosure — finding the right person to talk to.
Structurally, the repo is split into two layers. The dataset itself lives here, while the live, searchable front-end is served at directory.disclose.io. The README is explicit about the division of labor: if you just want to look a program up, use the directory; if you want to add or correct a program in the open dataset, pull requests against this repository are the canonical mechanism. That git-based contribution model means every change to a program's disclosure posture — a new policy URL, a changed contact address, a revoked safe-harbor clause — is diffable and attributable in the commit history, which is quietly valuable for audit purposes.
The licensing story is worth pausing on. The repo metadata declares CC0-1.0, effectively placing the dataset in the public domain, while the README footer references a CC BY 4.0 license for the broader disclose.io content. For practitioners, the practical consequence is that program-list.json can be cloned, forked, mirrored, and embedded into internal tooling without attribution obligations — a deliberate choice to maximize downstream reuse in SOAR playbooks, report-generation pipelines, and disclosure-tracking dashboards.
The stated motivation goes beyond convenience. According to the README, diodb exists to drive adoption of Safe Harbor frameworks for researchers, simplify the process of finding the right contact and channel at an organization, and align finders and vendors around shared expectations of engagement. In other words, it is advocacy infrastructure: by making safe-harbor status a queryable field rather than something buried in a PDF policy, it creates gentle competitive pressure for organizations to formalize their programs. The topic tags — safe-harbor-framework, responsible-disclosure, legal, disclosure-policy — reinforce that this is as much a legal-tradecraft project as a technical one.
For an authorized researcher, the workflow integration is straightforward. Before reporting a finding, you pull the target organization's entry from program-list.json or search directory.disclose.io to confirm the program exists, verify its scope language, and identify the sanctioned reporting channel. This matters operationally because reporting outside authorized channels is both legally risky for the finder and useless for the target — a finding sent to a generic security@ alias that no one monitors is a finding that dies. The dataset collapses that ambiguity into a single lookup.
The ecosystem around the repo is unusually complete. Beyond the dataset and directory, disclose.io offers policymaker.disclose.io for generating a new VDP from scratch, a community forum at community.disclose.io, and the dioterms repository documenting standard disclosure terminology. That suite makes the project relevant to the defensive side of the house too: a CISO standing up a first disclosure program can generate policy language from policymaker, register the program in diodb, and immediately become discoverable to the researcher community.
Contribution mechanics are enforced by CI, which is where the repo's engineering discipline shows. A would-be contributor edits program-list.json, then normalizes it with a one-line jq invocation — jq --indent 3 -s '.[] | unique_by(.program_name)' — before opening a pull request. The automation validates the JSON structure, rejects duplicates keyed on program_name, and verifies that referenced links resolve. The README candidly notes that failing to run the formatter is the single most common reason a PR goes red, which tells you the maintainer team has optimized for reviewer time.
From a blue-team perspective, the dataset doubles as inventory hygiene tooling. Defensive teams can diff program-list.json periodically against their own org's security-contact reality: if your entry points at a deprecated hackerone.com profile or a contact who left two years ago, that is a finding in itself. Because the file is plain JSON under CC0, mirroring it internally and wiring it into a nightly cron job or SOAR enrichment step costs essentially nothing.
The obvious caveat with any community dataset is freshness. Entries are only as current as the last contributor who cared, and a program's scope or safe-harbor language can change on the vendor's side without anyone opening a PR here. The README partially mitigates this by pointing casual users at the always-current directory.disclose.io front-end, but professionals should still treat each entry's linked policy page as authoritative and re-verify before acting on it.
What diodb ultimately represents is the boring-but-critical plumbing of coordinated disclosure. Offensive tooling gets the attention, but the mechanism by which a finding actually reaches a vendor with legal protection for the finder is what makes the ecosystem function. By making that mechanism open, queryable, and community-owned, disclose/diodb lowers the friction on both sides of the exchange — and for authorized professionals, it belongs in the bookmark bar next to your recon tooling, not as an afterthought.
disclose/diodb.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.