# Vulnerability handling

URL: /systems/legal-and-corporate/floor/vulnerability-handling · Id: `floorRow:vulnerability-handling`

> Vulnerability handling publishes a disclosure policy, fixes reported flaws without delay, and reports an exploited one to the regulator within 24 hours.

Vulnerability handling publishes a disclosure policy, fixes reported flaws without delay, and reports an exploited one to the regulator within 24 hours.

| Property | Value |
| --- | --- |
| Wakes | A Startup sells Software or an App in the EU, or publishes any Interface. |
| Process | [Vulnerability disclosure](/workflows/processes/vulnerability-disclosure) |
| Signs | [Security Engineer](/agents/engineering/security-engineer), [Engineering Team](/agents/engineering) |
| Sources | EU Cyber Resilience Act, Regulation (EU) 2024/2847, Arts. 13–14 and Annex I Part II; ISO/IEC 29147 and 30111; RFC 9116: security.txt |