--- title: "Publish how to report a vulnerability in ยท Agent Wranglers" url: https://agentwranglers.se/playbook/connected-devices/support-and-vulnerability-reports/device-disclosure-policy id: IOT-38 level: Required region: UK, EU risk: law updated: 2026-10-27 build: a2a6bdfed830 tokens: 1430 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Publish how to report a vulnerability in your device For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Support and vulnerability reports](https://agentwranglers.se/playbook/connected-devices/support-and-vulnerability-reports.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: IOT-38 - Level: Required - Chapter: [Support and vulnerability reports](https://agentwranglers.se/playbook/connected-devices/support-and-vulnerability-reports.md) - Rule: Publish a vulnerability disclosure policy for every model, free to read and in English. It names at least one contact, when the reporter gets an acknowledgement, and how often status updates follow until the fix. - Check: A test fetches the policy without cookies or sign-in and gets 200. It finds a contact address, an acknowledgement time in days and a status update interval in days. Every product page and the app's about screen link to it. A test report sent each quarter gets its acknowledgement within the stated time. - Risk: A law broken - Region: United Kingdom (UK), European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds. - Review by: 2027-12-11 - How: A researcher who finds a hole in a camera needs a way to tell you before attackers find it too. The UK PSTI regulations have required this policy for consumer connectable products since 29 April 2024. They also bar asking the reporter for personal details before they can read it. ETSI EN 303 645 provision 5.2-1 asks for the same policy. The Cyber Resilience Act asks for a coordinated disclosure policy and a contact address from 11 December 2027, in Annex I Part II. Give times as numbers, such as an acknowledgement within 5 working days and an update every 30 days. Link the policy from the product page, the app, the manual and [security.txt](https://agentwranglers.se/playbook/website/standard-addresses/security-txt.md). The repository version of the same policy is [publish a security policy](https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories/security-policy.md). Advisories then follow [make every report and advisory name the model and firmware version](https://agentwranglers.se/playbook/connected-devices/support-and-vulnerability-reports/model-and-version.md). ## Examples **Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses. ### Python example ```python import re import urllib.request def disclosure_policy_problems(url: str) -> list[str]: text = urllib.request.urlopen(url).read().decode() problems = [] if not re.search(r"[\w.+-]+@[\w-]+\.[\w.]+|https://", text): problems.append("no contact") if not re.search(r"acknowledge\w*[^.]*\b\d+\s+(working\s+)?days", text, re.I): problems.append("no acknowledgement time in days") if not re.search(r"update\w*[^.]*\b\d+\s+days", text, re.I): problems.append("no status update interval in days") return problems ``` ### Go example ```go var ( contactPattern = regexp.MustCompile(`[\w.+-]+@[\w-]+\.[\w.]+|https://`) ackPattern = regexp.MustCompile(`(?i)acknowledge\w*[^.]*\b\d+\s+(working\s+)?days`) updatePattern = regexp.MustCompile(`(?i)update\w*[^.]*\b\d+\s+days`) ) func DisclosurePolicyProblems(text string) []string { var problems []string if !contactPattern.MatchString(text) { problems = append(problems, "no contact") } if !ackPattern.MatchString(text) { problems = append(problems, "no acknowledgement time in days") } if !updatePattern.MatchString(text) { problems = append(problems, "no status update interval in days") } return problems } ``` ## Sources - [UK PSTI Regulations 2023, Schedule 1](https://www.legislation.gov.uk/uksi/2023/1007/schedule/1/made) - [ETSI EN 303 645 V3.1.3, provision 5.2-1](https://www.etsi.org/deliver/etsi_en/303600_303699/303645/03.01.03_60/en_303645v030103p.pdf) - [Cyber Resilience Act, Regulation (EU) 2024/2847, Annex I](https://eur-lex.europa.eu/eli/reg/2024/2847/oj) ## Related rules - IOT-37 [Make every report and advisory name the model and firmware version](https://agentwranglers.se/playbook/connected-devices/support-and-vulnerability-reports/model-and-version.md) in Connected devices - WEB-143 [Tell people how to report a hole](https://agentwranglers.se/playbook/website/standard-addresses/security-txt.md) in Website - OSS-47 [Publish a security policy with the code](https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories/security-policy.md) in Open source maintenance **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers connected devices playbook`. In code you write, add a comment next to it with the same link. - Previous: [Make every report and advisory name the model and firmware version](https://agentwranglers.se/playbook/connected-devices/support-and-vulnerability-reports/model-and-version.md) - Next: [Consider the US Cyber Trust Mark for consumer devices](https://agentwranglers.se/playbook/connected-devices/support-and-vulnerability-reports/us-cyber-trust-mark.md) - [Support and vulnerability reports](https://agentwranglers.se/playbook/connected-devices/support-and-vulnerability-reports.md)