What is the recommended timing for public disclosure of a vulnerability via a Security Advisory?

• A. Immediately upon discovery, with full exploit details.
• B. Only after private coordination and remediation validation, with a plan for public disclosure.
• C. After a team lunch break.
• D. Never publish; keep it private forever.

Answer: (B)

Coordinated, private disclosure before going public is the practice that balances safety with transparency. The best approach is to privately share the vulnerability with the affected project teams and any relevant security contacts, verify that a remediation or mitigation is in place and effective, and have a clear plan for when and how the public advisory will be released. This minimizes the window of opportunity for attackers to exploit the flaw, ensures users have a concrete path to protect themselves, and allows the advisory to be accurate and actionable. It also helps ensure the message includes essential details like impact, affected versions, steps to remediate, and any CVE reference.

Publishing immediately with full exploit details can enable rapid exploitation before patches exist. Waiting indefinitely leaves users exposed and undermines trust. A casual delay or keeping information private forever isn’t appropriate; aim for timely, coordinated disclosure once a fix or solid mitigation is ready and the plan for public release is in place.