# Security Disclosure Track

> Track private vulnerability reports from triage through fix, CVE coordination, embargo, publication, and post-disclosure closure

- Skill: `jmagly-ai-writing-guide/security-disclosure-track` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add jmagly-ai-writing-guide/security-disclosure-track`
- Raw SKILL.md: https://api.skillmd.com/api/skills/jmagly-ai-writing-guide/security-disclosure-track/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: jmagly (https://skillmd.com/u/jmagly-ai-writing-guide)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/jmagly-ai-writing-guide/security-disclosure-track

---


# Security Disclosure Track

Manage the advisory lifecycle after `security-report` intake. This is the closure-loop companion for private vulnerability disclosure and completes curl Practice 27 coverage.

## Stages

1. **Triage**: validate scope, severity, affected versions, reproduction, reporter contact, and embargo clock.
2. **Fix**: create private implementation plan; avoid public issue leakage; record commits/patches by hash.
3. **CVE**: determine whether CVE assignment is needed; record CNA/contact path.
4. **Publication**: prepare advisory, patched versions, acknowledgements, and release notes.
5. **Close**: confirm disclosure complete, custody record finalized, public advisory linked.

## Custody Record

Records live under `.aiwg/security-engineering/reviews/disclosures/` and are ignored by default. Each transition appends timestamp, actor, evidence, decision, and next deadline.

## References

- `agentic/code/frameworks/security-engineering/skills/security-report/SKILL.md`
- `agentic/code/frameworks/security-engineering/templates/SECURITY.md`