What is full disclosure in cybersecurity, and when do researchers use it?

A security research team recently discovered a serious vulnerability in Cursor, a popular AI-assisted code editor. The team decided to publicly disclose the finding, and that decision reignited a long-running debate in the cybersecurity world: when should a vulnerability be made public?

Traditionally, security researchers who find a flaw report it privately to the affected company and give it a reasonable window to develop a fix before saying anything publicly. This approach is known as "responsible disclosure," and its goal is to get the vulnerability patched before malicious actors can exploit it.

But in some cases, researchers conclude that a company isn't moving fast enough, or isn't taking the issue seriously. That's where "full disclosure" comes in: the researcher publishes detailed technical information about the flaw publicly, aiming both to warn users directly and to pressure the company into acting.

Proponents of full disclosure argue the approach gives users the chance to understand their risk and protect themselves. When a flaw stays hidden, users remain exposed without knowing it; public information, by contrast, at least lets them take temporary precautions.

Critics counter that full disclosure can also hand malicious actors a roadmap before a fix is ready. Once technical details of a vulnerability go public, that information reaches defenders and attackers at exactly the same time.

In the Cursor case, the research team said it had contacted the company before publishing its findings. The team judged the response insufficient or too slow, and decided that informing users took priority over waiting any longer.

AI-assisted code editors are especially concerning targets for this kind of vulnerability because they're deeply woven into developers' daily workflows. An attacker who compromises such a tool could potentially gain access to a developer's source code, credentials and other sensitive data.

A middle path known as "coordinated disclosure" has grown more common across the industry in recent years. Under this model, the researcher and the company agree in advance on when and how a vulnerability will be made public, aiming to balance transparency with user protection.

Experts say there's no fixed rule for which approach is "correct" — the right call can depend on the severity of the flaw, how quickly the company responds, and how many users are affected. Each case, in that sense, gets judged on its own terms.

The Cursor case underscores that as AI tools rapidly embed themselves in software development, the debate over how vulnerabilities should be handled is becoming less theoretical and increasingly practical.