How It Works
Harbor Project helps nonprofits and researchers coordinate vulnerability disclosure with clear scope, consistent reporting, and secure communication from first submission to final resolution.
Overview
The platform provides a shared workflow that reduces ambiguity across triage, remediation, and disclosure. Every report is tied to a specific program policy so both parties understand authorization boundaries and response expectations.
How It Works for Organizations
Program setup
Organizations create a profile, define owned assets, publish response commitments, and establish scope to ensure testing remains authorized and controlled.
Triage and remediation
Incoming reports are reviewed in a structured queue. Teams can request clarifications, assign priorities, and track remediation progress through final closure.
How It Works for Researchers
Program discovery
Researchers browse active programs and inspect scope definitions, safe harbor terms, and report requirements before testing.
Report submission
Researchers submit findings using structured forms that capture affected assets, reproduction instructions, impact context, and optional evidence attachments.
Responsible Disclosure Process
The process is designed to keep communication coordinated and non-adversarial. Researchers report privately, organizations validate and fix, and disclosure timing follows policy and risk management considerations.
Workflow Diagram (Step List)
- 1Organizations create a disclosure program with policy and contact expectations.
- 2Organizations define scope, out-of-scope assets, and testing constraints.
- 3Researchers browse participating programs and review safe harbor language.
- 4Researchers submit structured vulnerability reports with reproducible evidence.
- 5Organizations triage findings, remediate issues, and provide closure updates.
Bug Bounty Programs
Organizations may run bounty programs alongside disclosure policies. If enabled, reward eligibility is defined by the participating organization based on scope, severity, and report quality.
Security and Safe Harbor
Harbor Project emphasizes clear scope definitions, safe harbor policy language, and secure communication channels so good-faith research can occur within authorized boundaries.
Getting Started
Organizations can launch by publishing a scope and response policy. Researchers can begin by reviewing active programs and following responsible disclosure requirements for in-scope assets only.