I don't know what kinds of pentests you've seen but those automated scans are just for checking boxes. I'm talking about source-available pentests which sounds

I don't know what kinds of pentests you've seen but those automated scans are just for checking boxes. I'm talking about source-available pentests which sounds like the "real security audits" you are talking about. > The purpose of an engagement like that is expressly to find and patch 0days, so requiring that CVD be done in a specific way is just an implementation detail. All of the engagements I have been a part of have had NDAs and public disclosure of vulnerabilities would probably result in a lawsuit, but these have been for private companies. > My source for this is that I require them, and many (although certainly not all) other researchers I have talked with do as well. Do you work for an organization or just yourself?