...

Another possibility is to make use of a third-party bug bounty or coordination platform. For more information on common CVD tools, see Section 7.

Encourage Reporting

Anyone who becomes aware of a vulnerability that does not appear to have been remediated should report the vulnerability to the vendor. One should not assume that a vendor is aware of a specific vulnerability unless it has already been publicly reported, whether by the vendor or elsewhere. The easier it is to report vulnerabilities to a vendor, the less likely that the vendor will be surprised by vulnerability reports disclosed directly to the public.

Aside from the technical aspects of encouraging reporting, vendors can also provide reporters with other incentives, as discussed in Section 2.4.

Reduce Friction in the Reporting Process

...

• the exact product version(s) affected
• a description of how the vulnerability was discovered (including what tools were used) or what you were doing when you encountered the vulnerability
• proof of concept (PoC) code or reproduction instructions demonstrating how the vulnerability might be exploited
• ideally, a suggested patch or remediation action if the reporter is aware of how to fix the vulnerability

• description of the impact of the vulnerability and attack scenario (Kymberlee Price discusses the importance of providing a clear attack scenario in her article \ [1]).

• any time constraints (for example, give a date of publication or presentation at a conference if you know)

...

Reporters that do not provide enough information to a vendor or coordinator may find their reports delayed or even rejected. Using CWE [2] or CAPEC [3] as a reference might be helpful to describe the type of vulnerability you have found and common ways to fix it the problem.

An example of a template for a vulnerability report, based on the CERT/CC's own Vulnerability Reporting Form (VRF) [4], is provided in Appendix D. Vendors that require additional information to validate reports should clearly document their specific requirements in their vulnerability disclosure policy, reporting form, or process description

...