The Value of an Early Warning from Crowdsourced Cybersecurity Vulnerabilities

Using WooYun, a Chinese-crowdsourced responsible-disclosure platform, we examine how capital markets respond to private vulnerability reports in a responsible-disclosure workflow. WooYun provides an access-controlled pre-disclosure environment in which reports are verified, privately routed to affected firms, and managed within a remediation window before public exposure. Using 6740 vulnerability reports matched to 811 Chinese A-share listed firms during 2010–2016, we conduct a short-window event study around the private reporting date and find positive cumulative abnormal returns. These findings are robust to alternative return models, event windows, and placebo tests. We discuss the pattern through a near-miss framing as one possible interpretation. Trading-based analyses support an information-asymmetry channel, with stronger effects when informed trading is more likely. Overall, our results link responsible-disclosure system design to information visibility and market consequences, with implications for platform governance and cybersecurity economics.