SECNORA Coordinated Vulnerability Disclosure Policy

1. Purpose

SECNORA operates a coordinated vulnerability disclosure (CVD) program and is in the process of becoming a CVE Numbering Authority (CNA) under the CVE Program. This policy explains how SECNORA receives, coordinates, and discloses security vulnerabilities within its scope, so that affected parties can remediate before details become public and the security community can engage with us on clear, predictable terms.

The CVE-assignment provisions in this policy (in particular Sections 5–6) describe how SECNORA will operate once authorised as a CNA and take effect on authorisation. Until then, SECNORA coordinates disclosure and works with the relevant existing CNA — or the CNA of Last Resort (CISA / MITRE) — to obtain CVE identifiers for eligible vulnerabilities.

This policy is written to align with the CVE Program CNA Operational Rules and recognised coordinated vulnerability disclosure practice.

2. Scope

This policy applies to vulnerabilities within SECNORA’s CNA scope, as published in the CVE Program CNA List. The authoritative scope statement is maintained in SECNORA’s CNA record; where this policy and that record differ, the CNA record governs.

The following are out of scope for CVE assignment by SECNORA:

• Products or projects already covered by another CNA — report those to the responsible CNA (usually the vendor). We will redirect you where we can.
• Malware, and features of closed or private betas, which the CVE Program does not treat as eligible.
• Configuration issues, operational concerns, or design choices that do not meet the CVE Program’s criteria for a distinct, independently fixable vulnerability.

If a report falls outside our scope, we will tell you and, where possible, point you to the appropriate CNA or to the CNA of Last Resort.

3. Reporting a vulnerability to SECNORA

If you believe you have found a vulnerability within our scope, please report it to us before public disclosure so we can coordinate a fix.

Report to:  

Where you can, please include:

• The affected product and version(s).
• A description of the vulnerability and its impact.
• Steps to reproduce, a proof-of-concept, or the configuration needed to observe it.
• Any known mitigations.
• Whether the issue is already public or under active exploitation.
• How you would like to be credited, or that you wish to remain anonymous.

A non-disclosure agreement is not required to report to us.

4. What happens after you report

The 90-day window is a default, not a fixed rule. We will:

• Extend it by mutual agreement where a fix is genuinely in progress; and
• Shorten it, or disclose immediately, where the vulnerability is already public or is being actively exploited and earlier disclosure reduces overall risk.

Where SECNORA discovers a vulnerability itself, the same principles apply: we make a reasonable effort to notify the vendor or maintainer, agree a timeline, and publish the record with a public reference at disclosure.

5. CVE assignment and records

• SECNORA assigns CVE IDs only within its published scope, following the CVE Program CNA Operational Rules and counting rules.
• Each published CVE Record includes at least one accessible public reference that the CVE Program is permitted to link to.
• We do not require reporters to sign an NDA or to share embargoed information beyond what is needed to coordinate.
• Embargoed and pre-disclosure information is handled as TLP:RED by default until a mutually agreed public date, moving to TLP:CLEAR on publication.

6. Disputes and escalation

If you believe SECNORA has not handled an assignment in line with the CNA Rules — for example, an unreasonable delay, a refused assignment, or a record we have not populated — please raise it with us first at the contact address above. If it cannot be resolved, it may be escalated to our Root CNA under the CVE Program, which acts as the adjudication point for scope and rule-compliance issues. (Root to be named on onboarding.)

7. Safe harbour for good-faith research

SECNORA supports good-faith security research. If you make a good-faith effort to comply with this policy while investigating and reporting a vulnerability, SECNORA will consider your research authorised, will not pursue or support legal action against you for it, and will work with you to resolve the issue.

To stay within good faith, please:

• Only interact with systems or data you own or are explicitly permitted to test; do not access, modify, or retain more data than is necessary to demonstrate the issue.
• Avoid privacy violations, service degradation, data destruction, and disruption to others.
• Do not exploit the vulnerability beyond the minimum proof needed, and do not disclose it publicly before the coordinated date.
• Report promptly and allow reasonable time to respond.

This safe harbour covers SECNORA’s own conduct only. It does not authorise testing against third parties’ systems and does not bind vendors, maintainers, or other parties.

8. Credit

We credit reporters who wish to be named, using the name or handle you provide. Tell us if you would prefer to remain anonymous or if credit should be shared across a team.

9. Governance

This policy is reviewed at least annually and updated as the CVE Program rules and SECNORA’s scope evolve. Material changes to scope, contact details, or the disclosure location are reflected in SECNORA’s CVE Program CNA record.

SECNORA OÜ · Estonia · Registry code 14515469  Contact: · Policy: https://secnora.com/security/cve-disclosure-policy