Vulnerability disclosure
Vulnerability disclosure takes security reports at the published address, confirms them, fixes them, and credits the reporter under safe harbor.
Outcome
| Part | This Process |
|---|---|
| Outcome | Each security report is acknowledged within three days, fixed, and closed with the reporter told and credited if they agree. |
| Reads | Thread |
| Leaves | Issue, Change, Incident |
| On time | Within 3 days (calendar time); the clock never stops. Late Actions go to the Engineering Lead. |
| Runs in | Each Startup |
Accountable
Security Engineer, Engineering Team.
Responsible: Security Engineer.
Consulted: Engineering Lead, Legal Lead.
Informed: Communications Lead.
Workflows
| Workflow | Runs | Team |
|---|---|---|
| Handle a vulnerability report | on Thread.created where intake = 'security-reports' | Engineering Team |
Who does each step
| Workflow | Step | Role | Calls | Approval |
|---|---|---|---|---|
| Handle a vulnerability report | 1. Acknowledge the reporter in the Thread under the disclosure policy. | Security Engineer | Message.create | None |
| Handle a vulnerability report | 2. Reproduce the report and record it as an Issue with its severity. | Security Engineer | Issue.create | None |
| Handle a vulnerability report | 3. Open an Incident when the flaw is being exploited, which starts the regulator clock. | Security Engineer | Incident.open | None |
| Handle a vulnerability report | 4. Fix the flaw in a Change and verify the fix against the report. | Engineering Lead | Change.create | None |
| Handle a vulnerability report | 5. Tell the reporter, credit them if they agree, and close the Thread. | Security Engineer | Message.create | None |
Events
| Direction | When | What happens |
|---|---|---|
| In | On Thread.created where intake = 'security-reports' | Starts Handle a vulnerability report |
| Out | Message.created | Raised by step 1 of Handle a vulnerability report |
| Out | Issue.created | Raised by step 2 of Handle a vulnerability report |
| Out | Incident.opened | Raised by step 3 of Handle a vulnerability report |
| Out | Change.created | Raised by step 4 of Handle a vulnerability report |
Plays
No Play names this Process.
Controls
No Control names this Process or a Workflow of it.
Settings
None.
Failure
A failed step retries; when retries run out, the Action goes to the Engineering Lead.
| Step | On failure |
|---|---|
| Handle a vulnerability report 1. Acknowledge the reporter in the Thread under the disclosure policy. | Times out after 3 days. Goes to the Engineering Lead. |
| Handle a vulnerability report 2. Reproduce the report and record it as an Issue with its severity. | notReproduced: The flaw does not reproduce, so the reporter hears why and the Thread closes. Continues at close. |
Loop
No loop: the path is never randomized, because it serves Vulnerability handling.
Code
Turn on vulnerability disclosureEnable
On by default for every Product Template. Process.pause stops new Actions; Actions in progress finish.
Example
A researcher reports an exposed debug route through security.txt. The Security Engineer confirms it within a day, ships the fix as a Change, and credits the researcher on the disclosure page.