The government's Coordinated Vulnerability Disclosure Policy (CVDP) proposal aims to create a legal framework for ethical hackers. This comes after a controversial case involving four students who exposed a vulnerability in a popular app, raising questions about the fine line between cybersecurity and criminal prosecution. Vanessa Macdonald delves into what led up to this.