CV0-004 · Question #358
An independent security researcher discovers a potential vulnerability in a package. The vulnerability could lead to exposure. Which of the following is the first action the security researcher…
The correct answer is C. Report the vulnerability to the package vendor's security email. The first action in responsible disclosure is to privately notify the vendor through their security contact so they can investigate and fix the vulnerability before it becomes public knowledge.
Question
An independent security researcher discovers a potential vulnerability in a package. The vulnerability could lead to exposure. Which of the following is the first action the security researcher should take?
Options
- AUninstall the package to remove the threat.
- BWrite a blog post describing how the package vulnerability was discovered.
- CReport the vulnerability to the package vendor's security email.
- DOpen a public-facing issue on the vendor's Git repository.
How the community answered
(29 responses)- A3% (1)
- B3% (1)
- C93% (27)
Explanation
The first action in responsible disclosure is to privately notify the vendor through their security contact so they can investigate and fix the vulnerability before it becomes public knowledge.
Topics
Community Discussion
No community discussion yet for this question.