Do you find a potential vulnerability but lack a clear path to resolve it? Do you fear legal retaliation from the owner or collateral parties? This continuously researched responsible disclosure protocol offers a structured resolution path. We first surveyed existing practices from the technology sector's Common Vulnerabilities and Exposures (CVE) framework. We then adapted these practices for other industrial applications.
Continuous updates define this protocol. We revise the protocol periodically based on new case studies. Each chapter progresses step by step, which makes the document functionally purposeful. This protocol does not prescribe rigid rules. Instead, it consolidates procedures you can reference and modify according to your situation.
Under no circumstances does any project team assume responsibility for consequences, whether intended or unintended. You should implement this protocol only after you fully comprehend, agree to, and ratify its terms. When you deal with a vulnerability, life threatening risk may arise if the owner acts with malicious intent.
This document provides a living framework for responsible disclosure, not a legal guarantee. We encourage you to adapt the protocol with professional judgment and legal counsel where appropriate.
To secure the content from unauthorized modification by anyone down to bit-level
(0|1), they are cryptographically signed using one or more cryptography tools
such as but not limited to:
The public key and the associated certificate are attached. Only the main owner keeps and maintains the private keys. To verify the content's integrity:
- Install GnuPG software if not present.
- Download the target file and its detached signature file (the
.ascfile with the same filename). - Download the public key file (
.gpg). - Place them next to each other in the directory.
- Open a terminal and execute the following command:
$ gpg --no-default-keyring --keyring /path/to/public.gpg --verify /path/to/file.asc
- Install OpenSSL software if not present.
- Download the target file and its detached signature file (the
.sig/.signfile with the same filename). - Download the public certificate file (
.pem) containing the public key within. - Place them next to each other in the directory.
- Open a terminal and execute the following command:
$ openssl dgst -verify /path/to/pubkey.pem -signature /path/to/file.sig /path/to/file
Please refer to AI_DECREES.md for the project's policy on the use of Artificial Intelligence.
Please refer to CONTRIBUTING.md for contributing & maintenances guidelines.
- Agreed GIMP License
- Agreed GIMP Privacy Policy
- Agreed Inkscape License
- Agreed Inkscape Privacy Policy
- Agreed LibreOffice License
- Agreed LibreOffice Privacy Policy
This entire repository is licensed under Creative Commons Attribution-NoDerivatives 4.0 International License. To ensure better understanding of this license, the following sub-sections will briefly describe how to deploy the content.
For registered non-profit organizations (NGO), you are considered a
Commercial Entity the same as any for-profit organization by default. However,
you will be eligible for the NGO disbursement grant and receive exception
privileges from the creator(s).
Unless otherwise specified in writing, you MUST attribute back to the creator(s) as follows:
Title: Responsible Disclosure Protocol
Creators: (Holloway) Chew, Kean Ho
Packaged-By: (Holloway) Chew, Kean Ho
Contact: hello@chewkeanho.com
SKU: chewkeanho-research-responsible-disclosure-protocol
UUID: A447647E-4E9F-4DE2-8D65-3BC6C5D930D5
DOI: 10.5281/zenodo.20619283
License: Creative Commons Attribution-NoDerivatives 4.0 International License (https://creativecommons.org/licenses/by-nd/4.0)
Repository Made On: 2026-06-08
Repository Made From: Malaysia, South East Asia
Procure: https://doi.org/10.5281/zenodo.20619283
Note
This targets any customer wanting to own a copy of the content and then only he/she is using it without sharing with any 3rd-party entity; AND WITHOUT any monetary intention such as but not limited to:
- Saving a local copy and then viewing via his/her own mobile device(s); OR
- Saving a local copy and then viewing via his/her own personal computer; OR
- Saving a local copy for artificial intelligence data training purposes.
You are ALLOWED provided that you STRICTLY COMPLY with the license attribution.
Note
This targets any customer wanting to own a copy of the content and then only he/she is using it without sharing with any 3rd-party entity; AND WITH any monetary intention such as but not limited to:
- Saving a local copy for enhancing his/her company's procurement list; OR
- Saving a local copy for commercial artificial intelligence data training purposes.
You are ALLOWED provided that you STRICTLY COMPLY with the license attribution.
Note
This targets any customer wanting to refer or to provide a guide for sourcing the original content for any 3rd-party entity without directly displaying any portion of the original content; WITHOUT any monetary intention such as but not limited to:
- Academic research and paper writing; OR
- New content creation linking to the original content WITHOUT displaying any of the original content for his/her own streaming platform; OR
- Content production and collection linking to original content WITHOUT displaying any of the original content; OR
- Web portfolio project linking to the original content WITHOUT displaying any of the original content; OR
- Event materials linking the original content WITHOUT displaying any of the original content; OR
- Meeting materials linking the original content WITHOUT displaying any of the original content; OR
- Advertisement contents linking the original content WITHOUT displaying any of the original content.
You are ALLOWED provided that you STRICTLY COMPLY with the license attribution.
Note
This targets any customer wanting to directly display portions and NOT ALL of the original content as it is OR without any composing remixes or modifications retaining the original intent, art direction and messages into his/her content creation; WITHOUT any monetary intention such as but not limited to:
- New content creation with displaying portion(s) of the original content for his/her own streaming platform without any monetary gain; OR
- Content production and collection with displaying portion(s) of the original content without any monetary gain; OR
- Web portfolio project with displaying portion(s) of the original content without any monetary gain; OR
- Event materials with displaying portion(s) of the original content without any monetary gain; OR
- Meeting materials with displaying portion(s) of the original content without any monetary gain.
You are ALLOWED provided that you STRICTLY COMPLY with the license attribution.
Note
This targets any customer wanting to directly display portions and NOT ALL of the original content as it is OR without any composing remixes or modifications retaining the original intent, art direction and messages into his/her content creation; WITH any monetary intention such as but not limited to:
- New content creation with displaying portion(s) of the original content for his/her own streaming platform; OR
- Content production and collection with displaying portion(s) of the original content; OR
- Web portfolio project with displaying portion(s) of the original content; OR
- Event materials with displaying portion(s) of the original content; OR
- Meeting materials with displaying portion(s) of the original content; OR
- Advertisement materials with displaying portion(s) of the original content.
You are ALLOWED provided that you STRICTLY COMPLY with the license attribution.
Note
This targets any customer wanting to own and then modify the original content extensively preserving or altering the original intent, art direction, or message for composing his/her new content creation; WITHOUT any monetary intention such as but not limited to:
- New content creation with digitally modified and processed original content integration for his/her own streaming platform WITHOUT any profits including advertisement commission; OR
- Personal content production and collection with digitally modified and processed original content integration for his/her own streaming platform WITHOUT any profits including advertisement commission; OR
- Personal web portfolio project with digitally modified and processed original content integration for his/her own streaming platform WITHOUT any profits including advertisement commission; OR
- Social media meme content creation with digitally modified and processed original content integration for his/her own streaming platform WITHOUT any profits including advertisement commission.
You are NOT ALLOWED due to the license restriction.
Note
This targets any customer wanting to own and then modify the original content extensively preserving or altering the original intent, art direction, or message for composing his/her new content creation; WITH any monetary intention such as but not limited to:
- New content creation with digitally modified and processed original content integration for his/her own streaming platform; OR
- Personal content production and collection with digitally modified and processed original content integration for his/her own streaming platform; OR
- Personal web portfolio project with digitally modified and processed original content integration for his/her own streaming platform; OR
- Social media meme content creation with digitally modified and processed original content integration for his/her own streaming platform.
You are NOT ALLOWED due to the license restriction.
Note
This targets any customer wanting to share, to broadcast, to re-distribute, to sell, or to re-sell the original, modified, OR derived content WITHOUT any monetary intention such as but not limited to:
- Sharing with family members; OR
- Streaming the content via any streaming platform with private viewer access; OR
- Displaying the content in his/her gallery with privately invited guests; OR
- Displaying the content in private, free entry open spaces like living room; OR
- Owning a copy of the original content and serving it as downloadable content on a website in a private network (e.g. self-hosted home network); OR
- Sharing the original content across social media or messaging applications like email or instant messenger.
You are ALLOWED provided that you STRICTLY COMPLY with the license attribution.
Note
This targets any customer wanting to share, to broadcast, to re-distribute, to sell, or to re-sell the original, modified, OR derived content WITH any monetary intention such as but not limited to:
- Streaming the content via any streaming platform with public or private viewer access; OR
- Displaying the content in any company's public events with free or payable guest invites; OR
- Displaying the content in any company's internal/private events with free or payable guest invites; OR
- Owning a copy of the original content and serving it as free OR payable downloadable content on his/her website in any network (Internet, Intranet, or private networks); OR
- Sharing the original content across social media or messaging applications like email or instant messenger; OR
- Distributing the original content via multiple profit-earning streaming platforms.
You are ALLOWED provided that you STRICTLY COMPLY with the license attribution.