~/tutorials/046-when-you-find-something-real.md

046: When you find something real

Sooner or later the skills in this tier find a real bug in a real system somebody else owns. What happens next is a discipline, and the discipline is not optional equipment. It is the hat code, practiced as procedure.

The first hour

Verify it is real. Reproduce it twice from a clean state, then stop touching it. A finding you keep poking after confirming is a finding you are enjoying instead of handling, and every extra request is a decision you will explain later.

Write down the boundary you stayed inside. If you found it in a place with a published policy, quote the policy. If you found it somewhere with no policy, you were already off the road, and the honest writeup says so.

Then go quiet in the right way. No public posts, no screenshots, no telling the story until it is closed. Not because of etiquette. Because the clock has not started yet, and you control when it starts.

The report

A vulnerability disclosure is the report shape from lesson forty-three, compressed and aimed at one reader. The affected system, exactly. The reproduction, numbered, from a clean machine. The impact, in their vocabulary not yours. A fix if you can see one. What you did and did not touch, do, and access.

The field has settled formats: a markdown security advisory on a repository, a page under the vendor's own security directory, an email to the address in their policy. Use their format. Read their policy first, because it has clocks in it.

The clocks

Most policies promise a fixed window, commonly 90 days, from report to public. The bargain is symmetrical. You hold the details private while they work. They work, because at the end of the window the finding publishes whether or not the fix shipped.

Ninety days is not sentiment. It is the number that keeps both sides honest, and it was fought for. Honor it, extend it for good faith, and never let silence be the reason something publishes.

When they do not answer

It happens. The address bounces, the ticket closes itself, the vendor's reply is a lawyer.

The escalation ladder exists and it is boring on purpose. Try a second channel. Try a coordinator, a CERT or your national CSIRT, whose entire job is holding a finding between two parties who are not talking. Only the public route ends the ladder, and the decision to walk it belongs to the calmest version of you, weeks after the anger, if anger ever showed up.

This site practices it

The news files in this tree are disclosure reports, one per finding, each with its primary source in the frontmatter:

grep source: ~/news/2026-09-21-panos-globalprotect-cookie-auth-bypass.md

Every item cites where the finding came from, never a summary of a summary. That rule is the disclosure habit in miniature: the primary source is the receipt.

The tier, closed

This is where the road that started at a shell on somebody else's site ends: holding a real finding, in a real system, and doing the right thing with it because you practiced the right thing when nothing was at stake. The fifteen lessons before this one handed you the tools one at a time. This one hands you the code that decides what the tools are for.

Count what exists, the way this site always counts. The answer is 47 as this is written, and the command to check it is one line below:

ls ~/tutorials | wc -l

Three tiers, three rooms. First Steps taught the shell on a site that answers. Field Work taught judgment inside a jail that is honest about its limits. Live Fire taught the real tools, on your own iron, where nobody checks your output but you. Through all three, one rule never moved: the question before every command is whose machine it lands on.

The shell at the bottom of the page is still there, and the tree still goes deeper than the part you can see. Nothing here is finished, and neither are you. That is not a flaw in the ending. It is the design of the machine you started on, and now you run one of your own.

Try it

Read three disclosure reports from the news tree. Note which parts carry the weight: reproduction, impact, timeline.
Write one practice disclosure for a bug you planted in your own lab. Full shape, aimed at an imaginary vendor.
Keep it. The first real one will arrive with no warning, and it will be better for having a shape to fall back on.