Coordinated Vulnerability Disclosure (CVD) is a process for reporting a security flaw to the affected product owner, assessing it, and coordinating when and how details are released. A coordinator may help the researcher and organization communicate, agree on a timeline, and prepare a fix before public disclosure.
CVD matters because premature release can give attackers useful information before defenders can patch, while unclear handling can delay fixes or expose researchers and organizations to avoidable risk. In practice, researchers submit a report with evidence and reproduction details; vendors investigate and develop mitigations; and the parties coordinate a disclosure date. An embargo can support this process, but a breach may shorten defenders’ preparation time. CVD is a disclosure-management process, not automatic legal protection or authorization to test systems. Researchers should follow the channel’s rules, document their work, and avoid accessing data or systems beyond what is authorized.