# First-Party Disclosure Asserts Where Third-Party Disclosure Measures ## Claim When a vendor discloses a vulnerability in its own product it tends to state conclusions without the apparatus that would let a reader check them — no CVE, no CVSS, no researcher credit, no exploitation methodology — while a third party disclosing the same class of bug attaches the numbers, the code, and the dates that let anyone verify the severity independently. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Applies to any self-reported incident where the reporting party is also the party whose product failed: security advisories, outage postmortems, safety recalls, internal audit summaries released publicly. - Strongest where no external body compels a disclosure format — a CVE is optional, not required, for a vendor patching its own code. - Does not imply the vendor is lying; the Jetpack post's severity caveats are honest, just unquantified. The gap is what's measurable, not what's true. - Breaks down where regulation or a coordinating body forces a common format regardless of who discloses — mandatory breach-notification law, for instance, narrows this gap by design. - Weakens as the vendor's incentive to minimize shrinks; a vendor being sued or facing regulatory action discloses more like a third party would. ## Evidence > [!quote] ID:rw_01m1pq07av8vx92b4vpfzde04z > "This vulnerability could be used by a user allowed to import content on a site to have the site build PHP objects out of data the user supplied, which can lead to further attacks depending on what other code is running on the site." Automattic's 2026-09-02 post on Jetpack 16.1.3 discloses a PHP object injection in the Import feature, present since version 12.0 (2023) — roughly three years — plus two secondary fixes (a missing capability check in the Media API, unsanitized URL data in the Reader repost flow). None of the three carries a CVE, a CVSS score, or a named researcher. Compare the same week's Wordfence advisories, which routinely include CVE identifiers, CVSS scores, quoted vulnerable code, and exploitation counts for comparable severity. The post also concedes "no evidence of exploitation" without describing what was checked or over what window — an unfalsifiable reassurance that a third-party advisory, working from external telemetry, typically cannot get away with because it doesn't control the vendor's own logs. ## Links - [[3. Resources/Permanent Notes/The Maker Should Not Grade Its Own Homework]] — same family, different domain: that note is about independent verification of AI-agent or institutional output, this one is the security-disclosure instance of the identical structural problem — the party with the most information about a failure has the least incentive, and no external requirement, to quantify it. - [[3. Resources/Permanent Notes/Patch Coverage Is a Distribution Problem Not a Code Problem]] — contrasts inside the same source: that note (on the same Jetpack release) is about the exemplary *remediation* — 42 versions backported to every branch since 12.0.3 — while this note is about the deficient *disclosure*. The same vendor can lead the ecosystem on one axis and lag the ecosystem norm on the other in the same release. - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — applies-in: disclosure quality is part of what a host or site owner needs to assess exposure, and this note names why a first-party WordPress security notice is structurally thinner than a third-party one for the same bug class. - [[3. Resources/Permanent Notes/Comparing Adopters With Non-Adopters Credits the Tool for the Adopters' Prior Trend]] — has evidence from: adopters of a tool were already on a steeper trend than non-adopters, so an adopter comparison credits the tool for that trend. ## Tests / falsifiers - Sample a set of first-party vendor security disclosures against third-party (Wordfence, Patchstack, WPScan) advisories for comparable-severity bugs and count which fields (CVE, CVSS, researcher credit, exploitation data) each carries. If first-party disclosures routinely match third-party ones in detail, the claim is wrong. - Watch for a case where a vendor discloses in more, not less, detail than a third party for the same bug — that would falsify the asymmetry as stated rather than just narrow it. ## Source - [[3. Resources/Readwise/Full Document Contents/Articles/Jetpack 16.1.3 Critical Security Update]] — Automattic's own advisory for Jetpack 16.1.3, ~500 words, no byline. The comparison to Wordfence's same-week advisories is drawn from the deep-read appendix, not independently re-verified against those specific Wordfence posts; check before citing the comparison as measured rather than illustrative.