Zero Trust Vulnerability Reporting workflow #5232
Description
This issue is part of Project #79 – Zero Trust Vulnerability Reporting.
Goal
- Provide a zero-trust workflow for reporters to deliver vulnerability reports directly and securely to target organizations.
- Never persist sensitive vulnerability details in any file storage or database. Keep only minimal, non-sensitive metadata and artifact hashes for tracking, points, and program management.
Key Principles
- Direct delivery: Encrypt reports so only the recipient organization can decrypt (preferred: recipient public key).
- Minimal metadata: Store only non-sensitive metadata and artifact hashes; do not store vulnerability descriptions or PoC details.
- Ephemeral handling: Full vulnerability details exist only in memory or ephemeral worker storage while building the encrypted package; never persist plaintext to permanent storage.
- Out-of-band secrets: Any symmetric password must be delivered out-of-band (phone, SMS, separate email, secure messaging) and never stored with the report content.