Study responsible disclosure

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R02 — OWASP ASVS

   R35 — CVE/CISA disclosure guidance

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Study coordinated vulnerability disclosure (ISO 29147 concepts): authorization scope, safe data handling, minimal non-destructive PoC, maintainer communication, embargo timelines, and escalation paths.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   No separate task text for this block on day 73 — the sourced work sits in the block above. Keep the time box.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Responsible disclosure decision tree and reporting template added to portfolio repo.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R02OWASP ASVS↗ owasp.org

  Access-control, validation, authentication, file-handling, and logging requirements.

• R35NIST NVD & CISA KEV↗ nvd.nist.gov

  CVE records, CPE affected-version ranges, CVSS v3/v4 scoring context, and Known Exploited Vulnerabilities catalog.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsOWASP · standard
  OWASP Application Security Verification Standard

  Supplies the numbered verification requirements (V8 authorization, V6 authentication, V5 file handling, V16 logging) that let the disclosure report state which control failed rather than describing the bug loosely.

  R02checked 2026-11-11
• docsOWASP Cheat Sheet Series · 15 min read
  Vulnerability Disclosure Cheat Sheet

  The operational disclosure workflow — scope, safe handling, minimal reproduction, coordination and embargo — which day 73 turns into a decision tree.

  R02R35checked 2026-11-12
• videoMicrosoft for Java Developers
  From Vulnerability to Victory: Mastering the CVE Lifecycle for Java Developers

  Explains how a vulnerability moves from discovery through scoring and coordinated disclosure to public advisory, including which databases get updated and when — the embargo-to-publication timeline in practice.

  R35checked 2026-11-11
• articleCERT/CC, Carnegie Mellon University · guide chapter
  Phases of Coordinated Vulnerability Disclosure

  Adapts the ISO/IEC 30111 phase model — discovery, reporting, validation, prioritisation, remediation, public awareness, deployment — and assigns finder/vendor/coordinator duties per phase, which is the structure your disclosure plan should mirror.

  R02R35checked 2026-11-11
• docsOWASP · cheat sheet
  Vulnerability Disclosure - OWASP Cheat Sheet Series

  Gives the concrete mechanics — finding contacts, initial report contents, ongoing communication cadence, when to give up, and safe-harbour wording — for the minimal non-destructive PoC and maintainer correspondence the day asks for.

  R02checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.