Introduction: The Breakdown of Trust
The recent public disclosure of a zero-day vulnerability in Visual Studio Code (VS Code) by a security researcher marks a critical inflection point in the relationship between independent researchers and Microsoft’s vulnerability disclosure process. This decision was not arbitrary but a direct consequence of a systemic breakdown in trust, rooted in recurring failures within Microsoft’s handling of security vulnerabilities. Researchers, once integral collaborators, now increasingly question the reliability, transparency, and integrity of Microsoft’s processes, prompting a shift toward public disclosure as a last resort.
The Mechanism of Trust Erosion
At the core of this issue lies a structural communication failure that undermines the collaborative vulnerability disclosure framework. The intended process, designed to foster cooperation, typically unfolds as follows:
Submission: Researchers report vulnerabilities through Microsoft’s coordinated disclosure program.
