{"version":"0.2.0","built_at":"2026-10-10T20:58:14.188Z","license":"CC BY 4.0 © Mike Reams","canonical":"https://catalog.mikereams.com","capability":{"id":"BC-1270.40","name":"Vulnerability & Disclosure Handling","level":2,"parent_id":"BC-1270","l1_id":"BC-1270","industry":"software","macro_id":null,"path":["Trust & Compliance Assurance","Vulnerability & Disclosure Handling"],"description":"Receive vulnerability reports from researchers, customers and scanners, fix them within committed timelines, and tell affected customers what happened and what to do.","aliases":["Vulnerability Management","Bug Bounty","Security Advisories"],"in_scope":["Coordinated disclosure program and researcher intake","Triage, severity rating and remediation timelines","Security advisories and customer notification","Software supply chain and dependency vulnerability tracking"],"out_of_scope":["Enterprise vulnerability scanning of internal systems (see BC-760)"],"csdm_note":null,"status":"active","successor_id":null,"child_ids":["BC-1270.40.10","BC-1270.40.20","BC-1270.40.30","BC-1270.40.40"]},"crosswalk":{"realized_by":[],"used_in":[],"patterns":[],"stacks":[],"books":[]},"ancestors":[{"id":"BC-1270","name":"Trust & Compliance Assurance","level":1}],"children":[{"id":"BC-1270.40.10","name":"Disclosure Program & Intake","level":3,"child_count":0},{"id":"BC-1270.40.20","name":"Triage & Remediation","level":3,"child_count":0},{"id":"BC-1270.40.30","name":"Security Advisories & Notification","level":3,"child_count":0},{"id":"BC-1270.40.40","name":"Supply Chain Vulnerability Tracking","level":3,"child_count":0}]}