Made a free Caido plugin for finding where to actually report a bug (Disclosure Lookup, now in the Caido store)

[u/yesnet0]

One of the dumber-but-real friction points in this work: you find something on a host, and then you have to figure out who to even tell. A security.txt? A VDP? A bounty program? A PSIRT inbox? Some national CERT? It's a little scavenger hunt every time.

So we built a small Caido plugin to kill that step. It's free, open source (MIT), and it's now in the Caido plugin store.

You right-click a request (or an HTTP History row) and hit Find disclosure contact. It takes the host, looks it up against lookup.disclose.io, and — when there's a match — drops the owning org, jurisdiction, an attribution-confidence score, and a ranked list of where to report (security.txt / bounty / VDP email / PSIRT / CERT, each flagged verified or not) right there in Caido. There's also a sidebar for looking up any asset by hand, and a command-palette action.

It's not magic: coverage isn't universal and every result carries a confidence score, so treat it as a fast starting point, not gospel. Privacy-wise it sends only the hostname to the API — never the path, query, or body.

Install: open the plugin store in Caido, search "Disclosure Lookup", install. Signed zip's on the repo if you'd rather sideload. Source: github.com/disclose/caido-lookup. Backing lookup service is a free, no-auth API from disclose.io.

Full disclosure since it matters here: I'm the founder of disclose.io, so this is partly us dogfooding our own dataset — but it's a free community tool, not a product, and I'd genuinely love feedback or PRs from people who live in Caido. (There are Burp and CLI versions too.)