Visibility, not vulnerability

A vulnerability disclosure pipeline issued its first tracked identifier for a flaw only after the exploit was published on a public code repository. The same flaw had already entered the vendor’s private intake weeks earlier. In the private path it produced no identifier, no record, no observable state. In the public path it produced a CVE, an NVD entry, and a severity score within days.

The two events were identical in technical content. The same proof of concept, the same affected component, the same conditions for exploitation. What differed was the channel. One channel was quiet and addressed only the vendor. The other was open, indexed, and visible to everyone at once. The system reacted to the second and not the first.

Measured by the system’s own outputs, the private report did not exist. It generated no ticket that propagated outward, no public acknowledgment, no entry in any tracking database. The public post generated all of these in sequence. The disclosure system did not respond to the discovery of the vulnerability. It responded to the visibility of the vulnerability.

Coordinated disclosure was built on a single trust model: that the private channel between a reporter and a vendor is the authoritative path to remediation. The model assumes that a report, once submitted through the correct intake, enters a state that persists. The submission is treated as the beginning of a process that continues whether or not anyone observes it.

The assumption extends further. It treats trust as transferable across stages. Intake is assumed to represent triage. Triage is assumed to represent engineering attention. Acknowledgment is assumed to represent progress toward a fix. Each stage inherits the credibility of the one before it, and the reporter is asked to wait inside that inherited credibility on the belief that the chain holds end to end.

The model also assumes that the quiet channel and the loud channel are not in competition. Private reporting is positioned as the responsible path and public release as the irresponsible one, with the understanding that the responsible path will be rewarded with the same or better outcome. The entire structure rests on the premise that submitting privately and submitting publicly lead to the same destination, only by different routes. That premise is the load-bearing element. Everything else in coordinated disclosure is built on top of it.

What changed was not the reporter’s patience and not the vendor’s staffing. What changed was the validity of the assumption that the private channel carries trust all the way to an outcome. The channel still accepted input. It still returned the appearance of receipt. But the link between submission and remediation had quietly gone slack, and the system never tested whether it was still connected.

The disclosure pipeline did not re-evaluate that link at the moment it mattered. It inherited the trust established when the model was designed and continued to behave as though intake still implied action. A report entering the private path was treated as handled because reports entering that path had once been handled. The system carried forward a state that was true in the past and assumed it was still true in the present.

That assumption no longer holds. The quiet channel and the loud channel no longer lead to the same destination. One produces no observable movement. The other produces an identifier, a score, and global distribution within days. The system did not decide to favor the public path. It simply continued to measure what it had always measured, which was disruption, and disruption now arrived only through the public channel. The private report was not rejected. It was never weighed at all.

The disclosure pipeline acted on what it could reference. A public post is a fixed, addressable object. It has a URL, a timestamp, an index entry, and a record that other systems can point to and resolve. The pipeline issues identifiers against objects of this kind. The private submission produced no such object. It entered an intake, returned a receipt, and generated nothing that any external system could address. To the machinery that mints identifiers, the first report was not low priority. It was unaddressable.

At no point did the system validate the vulnerability in order to act. The two reports carried identical content, the same proof of concept and the same affected component, so content was never the variable. What the system validated was the existence of a public reference and the breadth of its distribution. The integrity of the finding had been established weeks earlier in the private channel and changed nothing. The identity of the source, public and indexed rather than private and quiet, changed everything. Reference stood in for verification. The system confirmed that the vulnerability was visible and treated that as confirmation that it mattered, when it had been real the entire time.

None of this was a bypass. The public post did not defeat a control or slip past a check. It supplied the system with exactly the input the system was built to consume, and the system produced exactly the output it was built to produce. A disclosure pipeline that mints identifiers in response to public exposure mints an identifier when exposure becomes public. The mechanism was not exploited. It was finally given the one signal it had been waiting for, and the private channel had never produced that signal. The artifact of visibility was the objective the system had been optimizing toward the entire time.

The pattern is execution based on reference, not verification. A system meant to act on a condition instead acts on an observable token that is assumed to represent the condition. When the token is present, the system moves. When the token is absent, the system is inert, and it is inert regardless of whether the underlying condition is identical in both cases. The reality is never the trigger. The reference to the reality is the trigger, and the two are not the same thing.

The same mechanism runs inside every detection program that measures itself by what it has logged. A monitoring system raises an incident when an event matches a signature in the log stream. The intrusion that produces a matching log produces an alert, an owner, and a tracked state. The intrusion that produces no log produces nothing, and the two intrusions can be technically identical. The system is not responding to the intrusion. It is responding to the record of the intrusion. Where there is a record, there is a reference the system can resolve, and the machinery moves. Where there is no record, the event did not occur as far as the system is able to determine, no matter what happened on the wire.

In both systems the observable artifact has quietly become the objective. The disclosure pipeline optimizes for visibility because visibility is what it can address. The detection program optimizes for logged events because logged events are what it can resolve. In each case the proxy has replaced the reality it was meant to stand for, and the system can no longer distinguish between a condition that is absent and a condition that is merely unreferenced. An unreported vulnerability and a remediated one occupy the same empty space in the record. An undetected intrusion and an absent one occupy the same silence. The system reads the absence of a reference as the absence of the thing.

A disclosure system resolves one question. It asks whether the vulnerability is visible, and it answers that question once.

It does not ask whether the vulnerability is fixed. Visibility was reported. Remediation was inferred from it, and the inference was never tested against the world.

The reference was created. The vulnerability was already real. The control exists. The outcome does not.