Agent Wranglers

IOT-38Required UK, EU law

Publish how to report a vulnerability in your device

Publish a vulnerability disclosure policy for every model, free to read and in English. It names at least one contact, when the reporter gets an acknowledgement, and how often status updates follow until the fix.

By Agent Wranglers. Updated .

Region

United Kingdom (UK), European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.

Review by

2027-12-11

How to do it

A researcher who finds a hole in a camera needs a way to tell you before attackers find it too. The UK PSTI regulations have required this policy for consumer connectable products since 29 April 2024. They also bar asking the reporter for personal details before they can read it. ETSI EN 303 645 provision 5.2-1 asks for the same policy. The Cyber Resilience Act asks for a coordinated disclosure policy and a contact address from 11 December 2027, in Annex I Part II. Give times as numbers, such as an acknowledgement within 5 working days and an update every 30 days. Link the policy from the product page, the app, the manual and security.txt. The repository version of the same policy is publish a security policy. Advisories then follow make every report and advisory name the model and firmware version.

Examples

Python example

import re
import urllib.request

def disclosure_policy_problems(url: str) -> list[str]:
    text = urllib.request.urlopen(url).read().decode()
    problems = []
    if not re.search(r"[\w.+-]+@[\w-]+\.[\w.]+|https://", text):
        problems.append("no contact")
    if not re.search(r"acknowledge\w*[^.]*\b\d+\s+(working\s+)?days", text, re.I):
        problems.append("no acknowledgement time in days")
    if not re.search(r"update\w*[^.]*\b\d+\s+days", text, re.I):
        problems.append("no status update interval in days")
    return problems

Go example

var (
	contactPattern = regexp.MustCompile(`[\w.+-]+@[\w-]+\.[\w.]+|https://`)
	ackPattern     = regexp.MustCompile(`(?i)acknowledge\w*[^.]*\b\d+\s+(working\s+)?days`)
	updatePattern  = regexp.MustCompile(`(?i)update\w*[^.]*\b\d+\s+days`)
)

func DisclosurePolicyProblems(text string) []string {
	var problems []string
	if !contactPattern.MatchString(text) {
		problems = append(problems, "no contact")
	}
	if !ackPattern.MatchString(text) {
		problems = append(problems, "no acknowledgement time in days")
	}
	if !updatePattern.MatchString(text) {
		problems = append(problems, "no status update interval in days")
	}
	return problems
}

How to check

A test fetches the policy without cookies or sign-in and gets 200. It finds a contact address, an acknowledgement time in days and a status update interval in days. Every product page and the app's about screen link to it. A test report sent each quarter gets its acknowledgement within the stated time.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/connected-devices/support-and-vulnerability-reports/device-disclosure-policy">Agent Wranglers connected devices playbook</a>. In code you write, add a comment next to it with the same link.