Research investigation R1010 / policy impact
Unreviewed OSS Scanner reports do not start Anthropic’s 90-day disclosure clock
The supplied documents distinguish automated delivery from notification of Anthropic’s later human validation. They also separate Anthropic’s publication timing from maintainers’ review, sharing and confidentiality obligations, while leaving an unresolved boundary between scanner-specific timing and the linked coordinated-disclosure policy.
This is a bounded policy comparison, not a test of scanner performance or actual disclosure practices. The sample comprises five primary documents. The CVD policy is marked last updated March 6, 2026; no immutable cutoff-time snapshot or pinned README commit was supplied.
This is a bounded policy comparison, not a test of scanner performance or actual disclosure practices. The sample comprises five primary documents. The CVD policy is marked last updated March 6, 2026; no immutable cutoff-time snapshot or pinned README commit was supplied.
- Dataset ID
- spd:when-does-oss-scanner-start-a-vulnerability-disclosure-clock-ec3854a3
- Stable URL
- /research/when-does-oss-scanner-start-a-vulnerability-disclosure-clock-ec3854a3
- Version
- Live
- Coverage
- Live collection
- Records
- 0
- Fields
- 7
- Updated
| Entity | Metric | Value | Unit | Observed | Source | Transform |
|---|
Measurement technique
How to read this report
- 01Compare the five supplied primary documents: Anthropic’s launch announcement, OSS Scanner overview and FAQ, enrollment README, service agreement and linked CVD policy. This synthesis uses saved evidence; it is not a new collection or experiment.
- 02Preserve the requested evidence cutoff of October 10, 2026, 15:30 UTC. The supplied snapshots were retrieved at 15:31:39.935 UTC, after that cutoff. Previously recorded live checks corroborate core wording but do not establish exact cutoff-time versions.
- 03Construct an evidence_matrix with separate rows for unreviewed scanner delivery, subsequent Anthropic human validation and ordinary CVD reports received after opt-out. Compare publication triggers, sharing permissions, review duties and exit effects.
- 04Keep scanner-specific provisions and the linked CVD policy separate wherever their timing is not expressly reconciled. Distinguish delivery configuration from permission to redistribute reports.
- 05Translate the comparison into a maintainer checklist: review before use or sharing; identify authorized recipients; record any Anthropic validation notice; seek clarification about early-publication exceptions; and distinguish pausing or withdrawing enrollment from ending existing report obligations.
Sources
Evidence
3 publishers supporting 0 records. Expand a publisher to inspect its cited pages.