Criteria used in the Scottish Government’s vulnerability disclosure policy: FOI release

Information request and response under the Freedom of Information (Scotland) Act 2002

Information requested

What criteria is used to determine “good faith” security research, as outlined in the Scottish Government’s Vulnerability Disclosure Policy.


The answer to your question is, in the context of the Vulnerability Disclosure Policy, ‘good faith’ is assessed by the ethics shown by the researcher in respect of actions carried out to probe vulnerabilities. Specifically the intent to disclose the vulnerability to the Scottish Government as soon as possible, and not to disclose it elsewhere or exploit it in any way.

About FOI
The Scottish Government is committed to publishing all information released in response to Freedom of Information requests. View all FOI responses at


Please quote the FOI reference
Central Enquiry Unit
Phone: 0300 244 4000

The Scottish Government
St Andrews House
Regent Road

Back to top