Neura Market
Disclosure Lookup – a Caido plugin that finds where to report a vuln logo

Disclosure Lookup – a Caido plugin that finds where to report a vuln

Free
FreeFree tier
Inputs: url
Type
Open Source
Company
disclose.io
Visit Website GitHub (2 stars)

About Disclosure Lookup – a Caido plugin that finds where to report a vuln

Disclosure Lookup is a Caido plugin that enables security researchers and penetration testers to find the appropriate vulnerability disclosure contact for any host without leaving the Caido interface. Users can right-click on a request or a row in HTTP History and select "Find disclosure contact" to trigger a lookup. The plugin queries the free, unauthenticated lookup.disclose.io API and returns detailed information including the owning organization, jurisdiction, attribution confidence, and a ranked list of reporting channels such as security.txt, bug-bounty programs, VDP emails, PSIRT directories, and national CERTs. Each contact is marked as verified or unverified. The plugin also provides a dedicated sidebar page for manual lookups and is accessible via the command palette. It is part of the disclose.io Project and is open source.

Key Features

Context-menu action: right-click on request pane or history row → Find disclosure contact
Dedicated sidebar page for manual asset lookup (domain, IP, URL, email, package)
Command palette integration for quick access
Queries free, CORS-open, unauthenticated lookup.disclose.io API
Displays owning organization, jurisdiction, attribution confidence
Ranked list of disclosure contacts with verified/unverified status
Supports multiple asset types: domain, IP, URL, email, package
Backend runs in Caido's sandboxed JavaScript runtime; communication via typed RPC bridge
Open source project under disclose.io

Pros & Cons

Pros
  • Free and open source with no API key required
  • Seamless integration into Caido's existing workflow
  • Provides both verified and unverified contact status for trust assessment
  • Multiple access methods: context menu, sidebar, command palette
  • Backend isolation enhances security of outbound requests
  • Part of the established disclose.io vulnerability disclosure ecosystem
Cons
  • Requires Caido as the host application; not a standalone tool
  • Depends on lookup.disclose.io database coverage; may not have entries for all hosts
  • Only provides contact information; does not automate report submission

Best For

Security researchers identifying proper channels to report vulnerabilitiesBug bounty hunters finding active programs for a target hostPenetration testers quickly locating VDPs and PSIRTs during assessmentsSecurity operations teams validating disclosure contacts for monitored assets

FAQ

What is Disclosure Lookup?
Disclosure Lookup is a Caido plugin that looks up security-disclosure contacts for any host. It is part of the disclose.io project and uses their free API.
How do I use Disclosure Lookup?
Right-click on a request or a row in HTTP History in Caido and select 'Find disclosure contact'. The plugin will query lookup.disclose.io and display the results.
Is Disclosure Lookup free?
Yes, the plugin is open source and free. The underlying lookup API is also free, CORS-open, and requires no authentication or API key.
What information does the plugin return?
It returns the owning organization, jurisdiction, attribution confidence, and a ranked list of disclosure contacts including security.txt, bug-bounty programs, VDP emails, PSIRT directories, and national CERTs. Each contact is marked as verified or unverified.
What types of assets can I look up?
You can look up domains, IP addresses, URLs, email addresses, and package names.