Agent Wranglers

APS-107Recommended

Publish a vulnerability disclosure policy

Publish a vulnerability disclosure policy at a fixed address and link it from security.txt. It names what is in scope, how to report, how fast you answer, and that you will not take legal action against good-faith research.

By Agent Wranglers. Updated .

How to do it

A policy tells a finder what to expect, so they report to you instead of posting the hole. State the systems in scope and the tests you do not allow, such as floods or reading other people's data. Give one reporting channel, such as a form or a monitored mailbox. Promise to acknowledge each report within the triage time in Fix each finding within the time its severity allows. Say when you will publish details, such as 90 days after the report or when the fix ships, whichever comes first. Point the Policy: field of security.txt at it. A product under the EU Cyber Resilience Act must have such a policy, as Handle vulnerabilities for the whole support period says. Open source projects follow Send private reports to at least two people.

Examples

Markdown example

# Vulnerability disclosure policy

Scope: example.com, api.example.com and our mobile apps.
Not allowed: denial of service, social engineering, reading other customers' data.
Report: https://example.com/security/report
We reply within 2 working days and publish details 90 days after your report, or when the fix ships if sooner.
Safe harbour: we will not take legal action for good-faith research that follows this policy.

How to check

The policy page answers 200, and the Policy: line of security.txt names it. A script reads the page and fails unless it holds the words scope, report, safe harbour and a number of days. A test report sent through the channel gets a reply from a person within the promised time.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/disclosure-policy">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.