Where to start
This site has a reading path for each of four situations: the pages that matter to a reader in that situation, in stages from first orientation to the detail.
Pick the description that matches your situation.
-
You handle vulnerability reports and coordinate cases with other organizations
How a case moves under Vultron, what it asks of each participant, and how it maps onto what you already do. If you lead a Product Security Incident Response Team (PSIRT) or a Computer Security Incident Response Team (CSIRT), this path also covers whether to adopt Vultron.
-
You maintain a vulnerability tracker and want it to talk to your partners
What your system sends and when, and where your own logic plugs in.
-
You study how vulnerability disclosure works and want the models behind it
The process models, the measurements built on them, and the formal protocol definition.
-
You want to work on the Vultron reference implementation
Run the demos, then learn how the codebase is built and why.
Have a vulnerability to report?
Vultron is a protocol, not a place to send a report.
Report it to the vendor through its security contact, which is often published in a security.txt file on its website.
If you cannot reach the vendor, or it does not respond, the CERT Coordination Center (CERT/CC) can coordinate the case: report it to CERT/CC.
The CERT Guide to Coordinated Vulnerability Disclosure explains what to expect along the way.
None of these describes you? Start with What Is Vultron?, which says what kind of thing Vultron is and what it leaves to your organization.