A few days ago I stumbled upon a bug report from 
While I love it when others find security vulnerabilities and holes in software the disclosure of the vulnerability needs to be done in a responsible manner. That's where Responsible Disclosure comes in. While there is no official definition and the topic of responsible disclosure is a heated topic in the cybersecurity community, the most basic definition is to give the developers time to fix the vulnerability before going public with it. So why do that? Well, for one, if it is a particularly nasty vulnerability in a software that is used by a lot of people you don't want to advertise to those hackers who's morals are a little shaky that there is a massive hole somewhere they could exploit and profit from. Take for example Wordpress. If you were to find a hole in WordPress that disclosed the administrator's password, as someone in the community you would want to notify the developers first before letting the world know the hole exists. If you didn't then there might be mass panic and a lot of people would be victims of the vulnerability before the developers can fix it.
Now there are some caveats to this. The first is that many developers will disagree with your findings because they don't want to admit they made a mistake. I think this is less prevalent in the opensource community as most of these developers are looking for all the help they can get. But I have seen it in my day job, working with corporate developers. I've had many an argument with a developer over how the vulnerability I discovered is just a "feature".
The other issue I've seen is that some companies out there will make you sign a non-disclosure form preventing you from telling anyone about it. Once you sign this form, they consider themselves safe and don't fix the issue. Now again, I don't see this happening much in the opensource community because you are less likely to come across a company backing opensource than you are to find just a bunch of developers who are doing this in their spare time. Of course, with Utopian, I can see some people creating businesses out of writing open source software too, so that may change.
Well, I'm not sure I have a perfect solution. I would like to suggest a few changes to the platform to encourage responsible disclosure first. The first change I'd like to suggest is either a change to the bug hunting rules or the creation of a new category of contribution named "Vulnerability Report". If I had my say in the matter I'd like to see a new category created name "Vulnerability Report". My suggestions for rules are as follows:
This will ensure that people understand that they need to contact the development team before releasing the vulnerability on Utopian. The moderators could judge the disclosure and provide a higher vote from the Utopian bot for those that do it right and a lower vote for those that tried and just didn't disclose it properly.
At the minimum, I'd like to see the "provide proof that you disclosed this to the development team" rule added to the Bug Hunting category to show people that they need to take the time to let the development team know and give them time to fix the issue.
So I'm no graphic artist, I literally just did this using the preview app on my Mac. But I think having some sort of hat as the icon would be cool. It's kind of a tip to white hat hackers. I'd like to give credit to the Hat Vector to The Noun Project who released it under the Creative Commons License.
So the other suggestion I had was to enable Utopian as a Bug Bounty program for opensource projects. It already is for the most part, but the way bug bounty programs work for vulnerabilities is that there needs to be a secure portal for a vulnerability researcher to send encrypted or secure messages to the development team. One way Utopian could help with this is by using the sponsored projects feature announced here. The way I understand it when a project sponsor applies to activate the project sponsorship feature the Utopian moderators create a new Steem account for that project. If this is the case then that steem account has a memo private and public key. This would allow for encrypted messages to be sent back and forth between the vulnerability researcher and the git hub developers who are authorized to use that account for upvoting.
As an example, say I find a vulnerability in the eSteem App. I would go to Utopian and click on contribution and choose Vulnerability Report. Once I put in the GitHub page for eSteem, Utopian could provide me with a popup saying "Would you like to securely communicate with the developers?". If I choose yes, then I could write out a short report notifying the developers that I've found a vulnerability. The Utopian application would then encrypt that message with the memo public key for the 
Now I know my second suggestion requires much more development work and engineering. I'm no developer so I have no idea about how to get at this, but I'd love to hear what others think in the comments section. Am I way off base or can this be done?
