Bugtraq

Bugtraq was created on November 5, 1993 by Scott Chasin in response to the perceived failings of the existing Internet security infrastructure of the time, particularly CERT. Bugtraq's policy was to publish vulnerabilities, regardless of vendor response, as part of the full disclosure movement of vulnerability disclosure. The list was sometimes spelled BugTraq, but common usage over the years called it Bugtraq. It grew to 2,500 subscribers by May 19, 1995 and over 40,000 by February, 2000.

Elias Levy, known as Aleph One (alluding to the cardinal number aleph one), noted in an interview that "the environment at that time was such that vendors weren't making any patches. So the focus was on how to fix software that companies weren't fixing." Levy considered the idea of abstracting Bugtraq to be platform-specific, to reduce irrelevant information for those interested only in particular operating systems.

Bugtraq was originally hosted at Crimelab.com, run by Scott Chasin. It was moved to the Brown University NetSpace Project, which has since been reorganized as the NetSpace Foundation, on June 5, 1995, the same day its moderation began. In July 1999 it became the property of SecurityFocus and was moved there. SecurityFocus was acquired in full by Symantec on August 6, 2002. In 2002, the Full-Disclosure mailing list was created because many people felt the list had "changed for the worse".

On April 30, 2020, Accenture Security completed its acquisition of Symantec's Cybersecurity Services including SecurityFocus, which included Bugtraq.

On August 6, 2026, Jonathan Brossard announced the acquisition of SecurityFocus and the Bugtraq name, describing the project as community-driven: "We are providing the platform. The community decides what it becomes."

Moderation

The mailing list was originally unmoderated, then received only occasional moderation that many participants considered inadequate. In one incident, what appeared to be sensitive credit-card information was allowed to be posted. Subsequent posts challenged many aspects of the list, including the full disclosure of vulnerabilities, and suggested it either go unmoderated or that moderators change the way they approached it.

Moderation began on June 5, 1995. Elias Levy moderated the list from June 14, 1996 until he stepped down on October 15, 2001. David Mirza Ahmad, one of the many co-authors of Hack Proofing Your Network, Second Edition, took over from Levy and continued until he stepped down on February 23, 2006. David McKinney, a DeepSight threat analyst at Symantec, took over from Ahmad. Moderation duties were later assumed by another DeepSight analyst, Prasanna.

During his tenure, Ahmad proposed the list adopt more "community involvement" and "a more democratic process for making important decisions on the future of Bugtraq and the Security Focus website". Despite receiving feedback according to Alfred Huger, further community involvement did not manifest.

Delays in moderation

Delays in list moderation occurred several times, sometimes due to technical issues and DDoS attacks. Other times, posts to the lists vanished due to unspecified "mail problems". In August 1997, the list went quiet for several days as Aleph One was on vacation and the person entrusted to moderate failed to do so. After the list was transitioned to SecurityFocus and Symantec acquired the company, some researchers noticed that their posts to the lists were delayed, as moderation no longer occurred on weekends. Despite the delays, vulnerability information from some of those posts was used in Symantec's DeepSight commercial offering which includes a vulnerability database.

Copyrighted advisories

In late 2000, when Levy posted the full content of a Microsoft security advisory to the list, Microsoft complained that it was a copyright violation.

As of February 24, 2020, Symantec stopped approving posts to Bugtraq. No final message from the list administrators and no statement from Symantec was posted. This came after the BID vulnerability database maintained by Symantec stopped being publicly updated on July 26, 2019, just over one month before it was acquired by Broadcom.

On January 1, 2021, Accenture announced that Bugtraq would be shut down. On January 15, 2021, what appeared to be a final email was sent to the list confirming it was being shut down, citing "resources for the BugTraq mailing list have not been prioritized". However, the decision was reconsidered based on feedback from the community; and on January 17, 2021, Accenture posted a message to the list announcing the continuation of Bugtraq, and followed up with a lengthier blog explaining their goals. Despite this reversal, the continuation announcement was the last message published to the mailing list, and no further posts appeared until the list's relaunch in August 2026.

On August 7, 2026, at DEF CON 34 in Las Vegas, Jonathan Brossard announced the relaunch of the mailing list as an independently operated, community-driven platform. DEF CON founder Jeff Moss posted to the relaunched list welcoming the effort and raising the question of full disclosure versus coordinated vulnerability disclosure as a topic for the community to navigate.