Vulnerability handling
Vulnerability handling publishes a disclosure policy, fixes reported flaws without delay, and reports an exploited one to the regulator within 24 hours.
| Property | Value |
|---|---|
| Wakes | A Startup sells Software or an App in the EU, or publishes any Interface. |
| Process | Vulnerability disclosure |
| Signs | Security Engineer, Engineering Team |
| Sources | EU Cyber Resilience Act, Regulation (EU) 2024/2847, Arts. 13–14 and Annex I Part II; ISO/IEC 29147 and 30111; RFC 9116: security.txt |