How to travel the C SAFely with .json when there are no Argonauts

## Overview Dina from Germany's BSI maps coordinated vulnerability disclosure onto the myth of Jason and the Argonauts, using CSAF JSON advisories as the modern "fleece" that helps researchers and vendors navigate disclosure safely.

## The Disclosure Problem Reporting a vulnerability feels like encountering an unknown "Minotaur": unclear policies, missing security.txt files, and fear of legal or professional retaliation. She contrasts manufacturer-centric "responsible" disclosure with coordinated disclosure mediated by neutral bodies.

## CSAF and BSI's Role CSAF provides machine-readable JSON for security advisories, enabling automation across government and industry. BSI acts as Medea—holding the fleece, brokering public advisories at the end of CVD, and shielding researchers when vendors push back.

## Takeaways Organizations should publish security.txt, adopt CSAF, and treat coordinated disclosure as a shared journey—not a back-room negotiation.