CVD Portal is live. You get a public portal where security researchers report vulnerabilities to you, a disclosure policy that researchers can read, and a dashboard where your team triages, scores and records each report.
Your own disclosure portal
Each company gets a portal on its own subdomain, for example acme.cvdportal.com. Researchers use it to send you a report without an account. The form asks for the affected product, the vulnerability category, a summary, the steps to reproduce and the security impact. A researcher can give a contact email so you can reply, or leave it blank and stay anonymous.
Every report arrives in your dashboard as a submission. You do not have to set up a mailbox, a ticket queue or a web form yourself.
Where to find it: Submissions. Your portal address is on the Settings page.
A published disclosure policy, with your PGP key
Your portal shows a coordinated vulnerability disclosure policy from the first day. The default text follows ISO/IEC 29147. It tells researchers what is in scope, what they must not do, and when they can expect an acknowledgement, an assessment and status updates. You can edit the text or return to the latest template.
You can also publish your PGP public key. Researchers can then encrypt the details of a report before they send it.
Where to find it: Settings, then PGP / Security.
Triage each report in one view
Each submission has one page with the tools your team needs to triage it.
- CVSS calculator. Select the metrics and the portal calculates the score, the severity and the vector string. It supports CVSS 3.1.
- Coordinator. Assign one team member as the owner of the report, so everyone knows who drives it.
- Request more info. Send a question to the researcher from the submission page. The portal records the request in your audit log.
Where to find it: Submissions, then open a submission.
See when Article 14 applies to a report
Each submission has a Severity & Art.14 Obligations panel. Mark a vulnerability as actively exploited, or record a severe incident, and the panel shows the three Article 14 notification stages with their deadlines. It marks a stage overdue when its deadline passes without a filing.
You can also record that a report is not actively exploited, so the decision is on file. Opening and preparing each stage report needs the Reporting plan.
Article 14 reporting obligations apply from 11 September 2026. The rest of the Cyber Resilience Act applies from 11 December 2027.
Where to find it: Submissions, then open a submission.
Export a CSAF 2.0 advisory
When you are ready to disclose, you can download a machine-readable CSAF 2.0 advisory for the submission. Your customers and their security tools can read it automatically. The CSAF export is part of the Reporting plan.
Where to find it: Submissions, then open a submission, then the advisory panel.
A record of every action
The portal writes an audit log entry when your team changes a report, a setting or an account. Each entry shows the time, the person and the action. The log is append-only, so nobody can change past entries. Use it to show an auditor who did what, and when.
Where to find it: Settings, then Audit Log.
These tools help you run a disclosure process. They do not make a product compliant with the Cyber Resilience Act on their own. This note is not legal advice.