The address a
researcher writes to.
A flaw someone has already found and cannot report is a flaw you will meet later, on someone else's terms. The route a finder takes to reach you is a control, and it fails quietly.
Say a researcher spends a Saturday afternoon on your product and finds something real — an endpoint returning another tenant's row, a debug flag nobody stripped before the last deploy, a token with no expiry. For the next hour you hold something valuable and perishable: a stranger who knows where your product is broken and wants you to fix it. Whether it reaches your team depends on plumbing you may never have built. No security@ in the footer, no /.well-known/security.txt, no page saying what happens after someone writes. The hour passes.
What a finder does when there is nowhere to write.
Reporting a flaw to a company that never asked for reports is unpaid work with legal risk attached. The finder guesses an address, guesses whether whoever opens it will understand what they are looking at, and guesses whether the reply is thanks or a letter from a lawyer. Each guess costs them something and returns nothing, so the cheapest move wins. Four things happen next: a post with a screenshot, a support ticket a first-line agent closes as a display bug, a DM to whoever's name is on the About page, or nothing at all. The last is the most common.
Silence feels like safety because it has no incident attached to it. The flaw outlives the tab closing: it waits, and the next person to notice may arrive with a different intention, or a buyer. Your first news of it is then an outage, an angry customer ticket, or a disclosure timeline someone else started.
Regulation makes the same assumption. The Cyber Resilience Act's reporting duty, which begins twenty-six days from now, attaches when a manufacturer becomes aware that a product is being actively exploited or has suffered a severe incident — an early warning inside 24 hours, per the European Commission's account of the obligation. A browser-only SaaS most likely sits outside it; recital 11 of Regulation (EU) 2024/2847 draws the line around what a user installs. Either way the clock hangs on the word aware, and awareness is the part you build yourself.
Reachable, answered, owned.
A disclosure path becomes a control the moment it guarantees three things a stranger can rely on before spending effort on you: that the report arrives somewhere real, that a human answers inside a time stated in advance, and that a named person owns what happens next.
- 01
Reachable without a relationship
Someone who has never met you, working from the product alone, finds where to send it in under a minute — footer, repo, or a machine-readable file at a path they already know to try. The address belongs to a role, so it survives whoever set it up leaving.
- 02
Answered inside a time you published
A finder who was told when to expect a reply will usually wait for it. One who has heard nothing for weeks starts drafting the post instead. The acknowledgement does not have to carry a fix — it has to carry proof a human read it, and to land when you said.
- 03
Owned by a name, with cover
Somebody is responsible for that mailbox on a Tuesday in August. Name them, name their backup, and settle in advance who authorises the two decisions a real report forces: an emergency deploy, and telling affected customers. A path ending in an inbox nobody owns delivers perfectly and still fails.
Publish the address, then prove it works.
Publish something a stranger can find
A role mailbox at
security@your own domain, plus a file at/.well-known/security.txtcarrying a Contact field and an Expires date, per RFC 9116. Both fit in one afternoon.Write the page it points at
Scope in and scope out, the reply time you will genuinely hit, and a safe-harbour line so a good-faith finder is not threatened for doing the thing you invited. OWASP's cheat sheet is a fair starting shape.
Send yourself a report and time it
From an address nobody recognises, on a Friday afternoon. Whatever happens is your actual control: routing, holiday cover, hours until a human answers. Re-run it whenever the team changes.
Nothing here is legal advice on whether the Cyber Resilience Act reaches your product — read the Regulation's own definitions, or ask someone whose job that is. OOPUO's disclosure path runs the order above: written scope, an agreed channel, and — with your permission — AI-assisted review against approved surfaces only.
Answering is the recurring cost.
The address itself is an afternoon's work; keeping it answered by a named person through holidays, handovers and the week you ship a rewrite is a standing obligation, which is the scope of operations work. Send the path a stranger would find today.