Legal Restrictions on Vulnerability Disclosure

This piece highlights a talk by Kendra Albert on how confidentiality clauses in managed bug bounty programs can restrict researchers from sharing vulnerability findings, undermining the original goals of coordinated vulnerability disclosure. It discusses when such contractual restrictions may be enforceable, offers guidance for researchers on their legal rights, and urges platforms and companies to align practices with the spirit of CVD by rejecting perpetual non-disclosure requirements.