Vultron Protocol Specification
The whole specification on one page
The specification is also published as a single page that holds every section and annex in order, for printing or for searching the whole text at once.
Abstract
The Vultron Protocol coordinates vulnerability disclosure among multiple organizations. Participants exchange asynchronous messages and track the case across four dimensions of shared state, realized as five state machines. Any number of organizations may take part in a single case.
Coordination is scoped to the case rather than to a system: the case-management role is held per case, and different cases may be managed by different actors. No single service holds every case. Within a case, one participant holds write authority over the case's shared state, so that concurrent claims resolve to one answer.
Parts
The specification is published one part per page. The parts are listed in reading order, and each page holds the sections listed beside it, from the introduction to the Internet Assigned Numbers Authority (IANA) and security considerations.
- Introduction and Overview: §1 Introduction, §2 Terminology, and §3 Protocol Overview.
- Protocol Layers: §4 Semantic Layer — Message Meanings and §5 Syntactic Layer — Wire Format.
- Case Tracking Models: §6 Report Management (RM) State Machine, §7 Embargo Management (EM) State Machine, §8 Case State (CS) Dimensions, and §9 Participant Embargo Consent (PEC) State Machine.
- Interactions and Lifecycle: §10 Model Interactions and Cascade Rules and §11 Participant Lifecycle Within a Case.
- Conformance: §12 Conformance.
- Considerations and References: §13 IANA and Namespace Considerations, §14 Security Considerations, and §15 References.
Annexes
The annexes illustrate and explain the protocol, and nothing in them is normative.
Annexes A and B trace Coordinated Vulnerability Disclosure (CVD) cases from first contact to closure.
- Annex A Worked Example: Single-Vendor CVD
- Annex B Worked Example: Multi-Party CVD
- Annex C Notation Reference
- Annex D Possible Case Histories
- Annex E Relationship to ActivityPub
- Annex F Behavior Trees as an Implementation Pattern
- Annex G Capability Shapes
Open Questions and the Single-Page Edition
Open Questions collects the questions this version of the specification leaves unresolved. The single-page edition holds every section and annex in order, for printing or for searching the whole text at once.
Reading path: You maintain a vulnerability tracker and want it to talk to your partners
This page is part of Build against the contract.
Before this page: