Responsible Disclosure Policy Template
A responsible disclosure policy template for manufacturers and software publishers. Uses 'responsible disclosure' terminology familiar to the security research community while meeting CRA Article 13 obligations.
Our Commitment to Security
Article 13(1)[COMPANY NAME] takes the security of our products seriously. We recognise that independent security researchers play an important role in identifying vulnerabilities before they can be exploited.
This Responsible Disclosure Policy sets out how to report security vulnerabilities to us, and what you can expect from us in return.
Responsible disclosure language is widely recognised in the security community and signals openness to researcher collaboration. The CRA uses 'coordinated vulnerability disclosure' — both terms are acceptable in practice.
What We Ask of Researchers
When researching and reporting vulnerabilities, please:
- Act in good faith — do not intentionally harm [COMPANY NAME], our users, or our services
- Minimise impact — only access the data necessary to demonstrate the vulnerability
- Report promptly — notify us as soon as you discover a potential vulnerability
- Coordinate disclosure — give us reasonable time to respond before publishing
- Keep it confidential — do not share details with others until we have addressed the issue
- Follow the law — research within the bounds of applicable law
Framing researcher obligations as requests rather than demands creates a more collaborative tone. The security research community responds better to 'please do X' than 'you must do X'.
How to Report
Article 13(1)Email: [[email protected]] Portal: [PORTAL URL] (for structured reports with automatic acknowledgment) PGP: Key fingerprint [FINGERPRINT] for encrypted reports
Please include:
- Which product or service is affected
- A description of the vulnerability
- Steps to reproduce
- Potential impact
- Any relevant screenshots or proof-of-concept code
We do not accept vulnerability reports via support tickets, social media, or public forums.
Offering both email and a portal gives researchers flexibility. The portal creates an automatic audit trail — important for demonstrating CRA compliance.
What to Expect from Us
Article 13(1)When you submit a vulnerability report, [COMPANY NAME] will:
✓ Acknowledge your report within 48 hours ✓ Keep you informed of our investigation progress ✓ Work with you to understand and validate the issue ✓ Notify you when we have released a fix ✓ Credit you publicly for your discovery (if you wish) ✓ Not pursue legal action against you for good-faith research under this policy
The checkmark format is visually clear and easy to scan. Committing to no legal action here (safe harbour) in positive terms — 'will not pursue' — is more reassuring than listing conditions.
Disclosure Timeline
Article 13(4)[COMPANY NAME] follows a [90]-day disclosure window from initial report. This means:
- We aim to release a patch or advisory within [90] days of your report
- We will discuss the timeline with you if we need more time
- We will provide advance notice before we publish our advisory
- We will coordinate with you on the content of any public disclosure
If a vulnerability is being actively exploited in the wild, we will prioritise faster remediation and disclosure.
90 days is the industry standard. Mentioning active exploitation handling shows researchers you understand the urgency dimension — and it aligns with your Article 14 internal obligations.
Safe Harbour
If you discover and report a vulnerability in good faith and in accordance with this policy, [COMPANY NAME] will not:
- Pursue legal or civil action against you
- Report you to law enforcement
- Terminate or restrict your access to our products solely because of your research
This safe harbour applies provided you did not intentionally access data beyond your own, did not disrupt our services, and reported to us before any public disclosure.
A clear, positive safe harbour statement is the most important element of any responsible disclosure policy. It is what convinces researchers to report to you rather than to the public.
Hall of Fame
[COMPANY NAME] maintains a public acknowledgment page at [HALL OF FAME URL] listing researchers who have responsibly disclosed vulnerabilities to us.
If you would like to be recognised, let us know your preferred name or alias when submitting your report. Recognition is entirely optional — you may report anonymously if you prefer.
A Hall of Fame (or Security Acknowledgments page) is a low-cost but effective way to incentivise responsible disclosure. Many researchers value recognition as much as or more than financial rewards.
Use this template automatically in CVD Portal
CVD Portal generates your CVD policy, tracks acknowledgments, and creates an audit trail — free, forever.
Set up your free portal