Coordinated Vulnerability Disclosure User Stories
• SEI Report
Publisher
Software Engineering Institute
Topic or Tag
Abstract
This white paper provides a set of user stories intended to guide the development of a technical protocol and application programmable interface (API) for Coordinated Vulnerability Disclosure (CVD). These user stories reflect internal discussions with the CERT/Coordination Center (CC) based on our own experiences in developing and using the VINCE platform as well as our ongoing CVD practices. The user stories are expected to be utilized by the CVD team to better understand, create, and implement a CVD Protocol. In addition, the CERT/CC believes that these user cases will be useful for any enterprise designing or implementing its own CVD policies, processes, and procedures.
Cite This SEI Report
Runyon, B., Hatleback, E., Householder, A., Manion, A., Sarvepalli, V., Snoke, T., Spring, J., Tyzenhaus, L., & Yarbrough, C. (2022, August 25). Coordinated Vulnerability Disclosure User Stories. Retrieved September 11, 2026, from https://www.sei.cmu.edu/library/coordinated-vulnerability-disclosure-user-stories/.
@techreport{runyon_2022,
author={Runyon, Brad and Hatleback, Eric and Householder, Allen and Manion, Art and Sarvepalli, Vijay and Snoke, Timur and Spring, Jonathan and Tyzenhaus, Laurie and Yarbrough, Charles},
title={Coordinated Vulnerability Disclosure User Stories},
month={Aug},
year={2022},
institution={Software Engineering Institute, Carnegie Mellon University},
url={https://www.sei.cmu.edu/library/coordinated-vulnerability-disclosure-user-stories/},
note={Accessed: 2026-Sep-11}
}
Runyon, Brad, Eric Hatleback, Allen Householder, Art Manion, Vijay Sarvepalli, Timur Snoke, Jonathan Spring, Laurie Tyzenhaus, and Charles Yarbrough. "Coordinated Vulnerability Disclosure User Stories." Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, August 25, 2022. https://www.sei.cmu.edu/library/coordinated-vulnerability-disclosure-user-stories/.
B. Runyon, E. Hatleback, A. Householder, A. Manion, V. Sarvepalli, T. Snoke, J. Spring, L. Tyzenhaus, and C. Yarbrough, "Coordinated Vulnerability Disclosure User Stories," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, 25-Aug-2022 [Online]. Available: https://www.sei.cmu.edu/library/coordinated-vulnerability-disclosure-user-stories/. [Accessed: 11-Sep-2026].
Runyon, Brad, Eric Hatleback, Allen Householder, Art Manion, Vijay Sarvepalli, Timur Snoke, Jonathan Spring, Laurie Tyzenhaus, and Charles Yarbrough. "Coordinated Vulnerability Disclosure User Stories." Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 25 Aug. 2022. https://www.sei.cmu.edu/library/coordinated-vulnerability-disclosure-user-stories/. Accessed 11 Sep. 2026.
Runyon, Brad; Hatleback, Eric; Householder, Allen; Manion, Art; Sarvepalli, Vijay; Snoke, Timur; Spring, Jonathan; Tyzenhaus, Laurie; & Yarbrough, Charles. Coordinated Vulnerability Disclosure User Stories. Software Engineering Institute. 2022. https://www.sei.cmu.edu/library/coordinated-vulnerability-disclosure-user-stories/