Scoring Guide

Privacy-Sensitive Disclosure Logic

For disclosures where technical details are withheld, the leaderboard uses privately held evidence and vendor confirmation to score impact without publishing exploit steps, affected endpoints, or examples of exposed personal data.

• Severity High is used when private evidence shows unauthorized access to sensitive personal information for other users. Critical is reserved for broad, easily repeatable exposure at substantial user-base scale, or where the receiving platform or vendor classifies it as Critical.
• Impact The impact evidence score is 2 when the affected data class, access path, vendor confirmation, and remediation evidence are documented privately.
• Novelty Zero-day means the issue was not publicly disclosed at submission time. A confirmed duplicate of a non-public vendor or platform report is still displayed as zero-day, but receives novelty score 1 rather than the full novelty score. Duplicate entries require a countable duplicate/original status. Official platform or vendor triage counts provisionally at 0.5 credit, and displays an asterisk, only when it is more than submission intake or generic pending review.
• Display Public records remain intentionally generic: the page can show confirmation, fix status, severity, and score logic, but not sensitive data types, PoCs, logs, or implementation details.

Display Notes

The public leaderboard only includes validated zero-day vulnerabilities and provisional officially triaged zero-day candidates. Already-public vulnerabilities are excluded from the table and kept only in private review notes with disclosure links. Zero-day status and originality are displayed as separate fields: zero-day answers whether the vulnerability was already publicly disclosed at submission time, while originality distinguishes first disclosures and zero-day duplicates. Confirmed duplicates of non-public reports are therefore zero-day, but not first disclosures. Submission intake, generic pending review, risk verification pending, New, Pending program review, needs more info, under review, Informative, Informational, or hidden status are withheld until countable confirmation is visible.

The records table shows a separate score-source column. Platform duplicate/original score means visible platform severity, especially the duplicate/original ticket's severity, is being used for the severity component. Course-side score means the course team assigned a conservative rubric score from private evidence. Course-side scores should be at least as strict as platform scoring and may be adjusted as more reports are reviewed.

Jointly discovered findings and provisional triaged findings are credit-weighted separately. For example, a finding shared by two groups may keep its base rubric calculation privately, but each group receives a 0.5 share of the credited score and finding count. An officially triaged but not finally confirmed finding receives 0.5 provisional credit and is marked with an asterisk until later confirmation.