Getting Started

Prerequisites

• Go 1.23 or later
• A SQLite database (created automatically)
• A domain name for federation (optional for local testing)

Installation

From source

git clone https://github.com/ivxlabs/disclosure.git
cd disclosure
go build -o disclosure ./cmd/disclosure

Create an account

./disclosure create-account --username alice --password secret --role researcher

Roles:

• researcher — can submit vulnerability reports
• vendor — can create bug bounty programs
• both — can do both

Run the server

./disclosure serve

The server starts on http://localhost:8080 by default.

Configuration

Create a configuration file disclosure.toml:

[server]
host = "0.0.0.0"
port = 8080
domain = "disclosure.example.com"

[database]
path = "/var/lib/disclosure/disclosure.db"

[tls]
enabled = false

See Configuration for all options.

First steps

1. Create your account using the create-account command
2. Log in at http://localhost:8080/login
3. As a vendor: Create a program and define its scope
4. As a researcher: Submit a report to a program
5. Communicate: Grant access, comment, and disclose through the platform

All report content is end-to-end encrypted — only the report author and the vendor with access can read it.