Marba$ec

▸ BLOG

CVEase: disclosure tracking that doesn't live in your head

After yet another coordinated disclosure this year, I took an honest look at how I was actually running the process, and it was not pretty. Findings lived in a Notion database. Follow-ups sat in my calendar. Vendor contacts were buried in a random email folder. And the deadlines? Those were in my head. Something was going to slip. It was only a matter of time.

Here's the thing nobody warns you about coordinated disclosure: it takes months from start to finish. One at a time, you can wing it. Once you have more than one going, or heaven help you, more than ten, "winging it" quietly turns into "dropping things." I needed a better way to organize the chaos.

So I built CVEase.

The CVEase dashboard: a vulnerability disclosure pipeline at a glance, with counts for active vulns, needs-action, waiting-on-vendors, published, and bounties earned, plus panels for stale vulnerabilities and follow-ups due, with the CVEase logo overlaid
CVEase, keeping my disclosures in order for once.

What it is

CVEase is a free, open-source desktop app for managing vulnerability disclosure from discovery all the way to the victory lap.

It's a Kanban-style board built around the actual stages of coordinated disclosure, with follow-up dates, deadlines, and stage-aware checklists, so you always know what the next move is. A few of the things it does that I was tired of doing by hand:

  • When it's time to reach out to a vendor, it pre-fills a disclosure email from the data you've already entered. No more writing the awkward first-contact note from scratch at 11pm.
  • It keeps you on track, nudging you to follow up when you need to.
  • When the embargo lifts, it drafts the public advisory in markdown, ready to drop straight into GitHub.
  • And when you want to admire your glorious bugs, your published findings live in a Hall of Fame that generates LinkedIn-ready posts for your adoring fans.

Your data stays yours

CVEase is local-first. Your findings never leave your machine to feed some SaaS vampire quietly selling your data downstream to the latest AI model. It's SQLite under the hood, with no telemetry, no account, and no cloud.

Did I mention it's free, open source, and runs on Windows, macOS, and Linux?

Grab it

I built CVEase for myself, because I was the one about to drop a disclosure. I'm sharing it in case it's useful to anyone else doing disclosure or research work and struggling to keep all the plates spinning.

It's on GitHub: github.com/marbas207/CVEase. Take it, use it, break it, and send me issues.

-Marbaṩ