How to handle a responsible disclosure you get from me?

(this is mostly cribbed and then adjusted to me and my style from https://blog.literarily-starved.com/2025/06/how-to-handle-a-responsible-disclosure-you-get-from-me/. Thank you Martin for giving me the go-ahead!)

Let’s assume you run an IT service or deliver some kind of device to customers, and you receive a report from me informing you about a security problem in your service or device. This can —and has—happened to some of the best in the industry. So, you’re not alone.

Now you’re wondering: What should you do with this disclosure?

Huzzah: This post is here to guide you through the process.

Let’s start with what’s bad about me reporting such a thing:

1. Most importantly: There is a very high probability that you (or a close supplier) have a somewhat serious problem. I don't nitpick and I only act when I see something I deem serious in some way or another.
2. I will have no hope, but also hold you to high standards. I’m investing my spare time because I believe the issue is serious enough to warrant it. I might stop interacting with you, but I will ring bells to get someone's attention — starting small, but escalating quickly if needed.
3. It is very likely that relevant authorities will be informed in parallel. I believe authorities can only act if they are aware of problems. So, I inform them — even if they don’t act in most cases.

Let’s continue with what’s good about me reporting such a thing:

1. Fixing the issue will most likely save you money and prevent far bigger trouble in the future.
2. I don’t want any money. My motivation is civic responsibility, not income. So you don’t need to open your wallet.
3. I didn’t “hack” your system. I won’t attempt to hack anything, I'm not even that technical anymore. Your problem is most likely an obvious and embarrassing one — which is good, because that usually means it’s easy to fix.
4. I don’t want to hurt you. My goal is to fix the problem, not to damage your reputation. This might happen anyway if you don’t fix the problem on your side.

What you shouldn’t do?

Some actions will only cause you more pain in the long run:

1. Ignore me: As mentioned above, I will use increasingly large and loud bells to get attention. This will draw more eyes to your problem, and probably not in a good way.
2. Threaten me: Attempting to silence me with threats (typically from your lawyers) won’t improve my mood nor resolve anythig. It’s very unlikely I’ll feel seriously intimidated, mostly because I firmly know and can prove that it wasn't me who did something wrong.
3. Ask me to sign an NDA: I report what I report. I won’t sign an NDA. There’s no upside for me — it only restricts my ability to push for a fix.
4. Refer me to a bug bounty platform: These often require signing NDAs (see above), and I have no interest in joining yet another platform. I don't want your money. Bug bounty programs don’t help my mission — unless they work via something as simple as sending an email to a listed address.

What can you do beforehand?

There’s one thing you can do in advance that will make such events much less painful:

➡️ Publish a security.txt file compliant with RFC 9116 at all your services.

Having this file means:

• I assume (initially) that you take security seriously.
• I’ll use the contact you specified to alert you.

You save everyone time and effort — which I appreciate.

The other thing you can do is to prepare procedures to work with such disclosures. Make sure that any possible input channel of your organization knows how to proceed if such a disclosure arrives. It won’t do any good if you have a security.txt but the message gets ignored because one person is on vacation.

So how should you reply?

I recommend that your reply addresses the following points:

1. Confirm receipt and establish a channel or contact for further communication.
2. Reflect your view of the analysis: severity, impact, scope.
3. Describe the next steps and a timeline.

Example of a near-perfect reply

Such a message would make me very happy:

Thank you for your disclosure. We have opened ticket #123456 to track this issue. You can contact us at incident@example.org for status updates or to provide new information.

We believe this vulnerability affects all customers using service X, especially group Y. We have identified the core problems as Z1 and Z2. We currently rate the severity as (your rating).

To address this, we need to resolve Z1 and Z2 by (your measures). This will take some time, and we can’t give a fixed timeline yet. However, we intend to implement a mitigation in service X within (number of days).

Unless you set an unreasonable timeline, I’ll leave you alone for that period.

My experience with such disclosures

Unless you’ve planned ahead, you very likely will fail to meet my expectations.

Footnotes

• My disclosure may trigger other legal implications for you. You may need to inform customers, shareholders or other relevant groups. That is your task. I epxect you to know and follow your obligations.
• You canot prevent me from writing a publicly available after action report. But you have great influence on how professional you look in it.
• I deeply dislike organisations that fix the problem, but do not communicate (neither to me or the public).
• My disclosures should be very easy to distinguish from the AI slob you get on other channels. I’ll try to make identifying the problem and severity as easy as possible.