{"title":"Unreviewed OSS Scanner reports do not start Anthropic’s 90-day disclosure clock","description":"The supplied documents distinguish automated delivery from notification of Anthropic’s later human validation. They also separate Anthropic’s publication timing from maintainers’ review, sharing and confidentiality obligations, while leaving an unresolved boundary between scanner-specific timing and the linked coordinated-disclosure policy.","dataset_id":"spd:when-does-oss-scanner-start-a-vulnerability-disclosure-clock-ec3854a3","canonical_url":"https://superpowerdaily.com/research/when-does-oss-scanner-start-a-vulnerability-disclosure-clock-ec3854a3","version_url":"https://superpowerdaily.com/research/when-does-oss-scanner-start-a-vulnerability-disclosure-clock-ec3854a3","version":"Live","snapshot_hash":null,"date_created":null,"date_modified":"2026-10-10T15:39:05.160Z","license":{"name":"Superpower Daily data reuse terms","url":"https://superpowerdaily.com/terms"},"license_url":"https://superpowerdaily.com/terms","coverage_note":"This is a bounded policy comparison, not a test of scanner performance or actual disclosure practices. The sample comprises five primary documents. The CVD policy is marked last updated March 6, 2026; no immutable cutoff-time snapshot or pinned README commit was supplied.","measurement_technique":["Compare the five supplied primary documents: Anthropic’s launch announcement, OSS Scanner overview and FAQ, enrollment README, service agreement and linked CVD policy. This synthesis uses saved evidence; it is not a new collection or experiment.","Preserve the requested evidence cutoff of October 10, 2026, 15:30 UTC. The supplied snapshots were retrieved at 15:31:39.935 UTC, after that cutoff. Previously recorded live checks corroborate core wording but do not establish exact cutoff-time versions.","Construct an evidence_matrix with separate rows for unreviewed scanner delivery, subsequent Anthropic human validation and ordinary CVD reports received after opt-out. Compare publication triggers, sharing permissions, review duties and exit effects.","Keep scanner-specific provisions and the linked CVD policy separate wherever their timing is not expressly reconciled. Distinguish delivery configuration from permission to redistribute reports.","Translate the comparison into a maintainer checklist: review before use or sharing; identify authorized recipients; record any Anthropic validation notice; seek clarification about early-publication exceptions; and distinguish pausing or withdrawing enrollment from ending existing report obligations."],"methodology":["Compare the five supplied primary documents: Anthropic’s launch announcement, OSS Scanner overview and FAQ, enrollment README, service agreement and linked CVD policy. This synthesis uses saved evidence; it is not a new collection or experiment.","Preserve the requested evidence cutoff of October 10, 2026, 15:30 UTC. The supplied snapshots were retrieved at 15:31:39.935 UTC, after that cutoff. Previously recorded live checks corroborate core wording but do not establish exact cutoff-time versions.","Construct an evidence_matrix with separate rows for unreviewed scanner delivery, subsequent Anthropic human validation and ordinary CVD reports received after opt-out. Compare publication triggers, sharing permissions, review duties and exit effects.","Keep scanner-specific provisions and the linked CVD policy separate wherever their timing is not expressly reconciled. Distinguish delivery configuration from permission to redistribute reports.","Translate the comparison into a maintainer checklist: review before use or sharing; identify authorized recipients; record any Anthropic validation notice; seek clarification about early-publication exceptions; and distinguish pausing or withdrawing enrollment from ending existing report obligations."],"metrics":[{"label":"Verified observations","value":"0","detail":"0 measured fields"},{"label":"Supported claims","value":"10","detail":"9 material findings"},{"label":"Cited sources","value":"5","detail":"5 primary or authoritative"},{"label":"Research score","value":"78","detail":"Automated topic and evidence score"}],"columns":[{"key":"entity","label":"Entity"},{"key":"metric","label":"Metric"},{"key":"value","label":"Value"},{"key":"unit","label":"Unit"},{"key":"observed","label":"Observed"},{"key":"source","label":"Source"},{"key":"transform","label":"Transform"}],"data":[],"sources":[{"name":"Anthropic","title":"An opt-in vulnerability-finding service for open-source software","url":"https://www.anthropic.com/research/launching-opt-in-vuln-finding-service-for-open-source","records":0},{"name":"Anthropic","title":"Coordinated vulnerability disclosure for Claude-discovered vulnerabilities","url":"https://www.anthropic.com/coordinated-vulnerability-disclosure","records":0},{"name":"Anthropic","title":"oss-scanner/README.md at main · anthropics/oss-scanner","url":"https://github.com/anthropics/oss-scanner/blob/main/README.md","records":0},{"name":"Anthropic","title":"red.anthropic.com","url":"https://red.anthropic.com/oss-scanner","records":0},{"name":"Anthropic","title":"red.anthropic.com","url":"https://red.anthropic.com/oss-scanner/terms","records":0}],"provenance":{"publisher":"Superpower Daily","source_count":5,"source_urls":["https://www.anthropic.com/research/launching-opt-in-vuln-finding-service-for-open-source","https://www.anthropic.com/coordinated-vulnerability-disclosure","https://github.com/anthropics/oss-scanner/blob/main/README.md","https://red.anthropic.com/oss-scanner","https://red.anthropic.com/oss-scanner/terms"],"methodology":["Compare the five supplied primary documents: Anthropic’s launch announcement, OSS Scanner overview and FAQ, enrollment README, service agreement and linked CVD policy. This synthesis uses saved evidence; it is not a new collection or experiment.","Preserve the requested evidence cutoff of October 10, 2026, 15:30 UTC. The supplied snapshots were retrieved at 15:31:39.935 UTC, after that cutoff. Previously recorded live checks corroborate core wording but do not establish exact cutoff-time versions.","Construct an evidence_matrix with separate rows for unreviewed scanner delivery, subsequent Anthropic human validation and ordinary CVD reports received after opt-out. Compare publication triggers, sharing permissions, review duties and exit effects.","Keep scanner-specific provisions and the linked CVD policy separate wherever their timing is not expressly reconciled. Distinguish delivery configuration from permission to redistribute reports.","Translate the comparison into a maintainer checklist: review before use or sharing; identify authorized recipients; record any Anthropic validation notice; seek clarification about early-publication exceptions; and distinguish pausing or withdrawing enrollment from ending existing report obligations."],"snapshot_hash":null},"distributions":{"csv":"https://superpowerdaily.com/api/research/when-does-oss-scanner-start-a-vulnerability-disclosure-clock-ec3854a3?format=csv","json":"https://superpowerdaily.com/api/research/when-does-oss-scanner-start-a-vulnerability-disclosure-clock-ec3854a3?format=json"}}