VulnCheck - Outpace Adversaries

What it is

VulnCheck's vulnerability disclosure policy, last revised on March 6, 2026, describes how VulnCheck reports vulnerabilities to vendors and when it publishes its own advisory. The headline terms are a 120 day deadline, cut to 7 days for in-the-wild exploitation. The catalog summary covers those. This note covers the terms it leaves out.

How it works

The page lists these steps:

• VulnCheck contacts the vendor with details and sets the 120 day deadline to patch or publish an advisory.
• It stays in regular contact to agree a date for a coordinated advisory.
• On the day the vendor ships a patch or advisory, VulnCheck publishes a third-party advisory.
• If the deadline passes with neither, VulnCheck publishes an uncoordinated advisory.

Preconditions / Affected

The 7 day deadline applies when VulnCheck itself determines the vulnerability is exploited in the wild. The page does not say what evidence VulnCheck requires or whether it tells the vendor how it decided. The stated aim is to remove the attacker's advantage and alert defenders.

What to do

For a vendor or product security team, the page implies the following:

• Expect pre-patch details to reach others. VulnCheck "may provide customers with vulnerability details" so they can take defensive measures while the patch is in development. Do not treat the vendor window as confidential.
• Publish a patch or advisory inside the window. The page offers no extensions, and any published patch counts as public disclosure for VulnCheck's purposes.
• Use email. VulnCheck says communication occurs exclusively over email.
• Do not route VulnCheck reports through a program that bars public disclosure or tries to control its work. VulnCheck will not take part.

Caveats

If a vendor says it does not intend to remediate or issue an advisory, the coordinated timeline "may no longer apply". The page does not say what happens instead. VulnCheck also reserves the right to deviate from or change the process as needed, so the stated deadlines are not binding commitments. The page gives no dispute process and no definition of "advisory" beyond the vendor publishing one.