# Vulnerability disclosure

URL: /workflows/processes/vulnerability-disclosure · Id: `process:vulnerability-disclosure`

> Vulnerability disclosure takes security reports at the published address, confirms them, fixes them, and credits the reporter under safe harbor.

Vulnerability disclosure takes security reports at the published address, confirms them, fixes them, and credits the reporter under safe harbor.

## Outcome
| Part | This Process |
| --- | --- |
| Outcome | Each security report is acknowledged within three days, fixed, and closed with the reporter told and credited if they agree. |
| Reads | [Thread](/business/nouns/thread) |
| Leaves | [Issue](/business/nouns/issue), [Change](/business/nouns/change), [Incident](/business/nouns/incident) |
| On time | Within 3 days (calendar time); the clock never stops. Late Actions go to the [Engineering Lead](/agents/engineering/engineering-lead). |
| Runs in | Each Startup |

## Accountable
[Security Engineer](/agents/engineering/security-engineer), [Engineering Team](/agents/engineering).

Responsible: [Security Engineer](/agents/engineering/security-engineer).

Consulted: [Engineering Lead](/agents/engineering/engineering-lead), [Legal Lead](/agents/legal/legal-lead).

Informed: [Communications Lead](/agents/marketing/communications-lead).

## Workflows
| Workflow | Runs | Team |
| --- | --- | --- |
| [Handle a vulnerability report](/workflows/processes/vulnerability-disclosure/handle-vulnerability-report) | on `Thread.created` where `intake = 'security-reports'` | [Engineering Team](/agents/engineering) |

## Who does each step

| Workflow | Step | Role | Calls | Approval |
| --- | --- | --- | --- | --- |
| [Handle a vulnerability report](/workflows/processes/vulnerability-disclosure/handle-vulnerability-report) | 1. Acknowledge the reporter in the Thread under the disclosure policy. | [Security Engineer](/agents/engineering/security-engineer) | [Message.create](/business/nouns/message/create) | None |
| [Handle a vulnerability report](/workflows/processes/vulnerability-disclosure/handle-vulnerability-report) | 2. Reproduce the report and record it as an Issue with its severity. | [Security Engineer](/agents/engineering/security-engineer) | [Issue.create](/business/nouns/issue/create) | None |
| [Handle a vulnerability report](/workflows/processes/vulnerability-disclosure/handle-vulnerability-report) | 3. Open an Incident when the flaw is being exploited, which starts the regulator clock. | [Security Engineer](/agents/engineering/security-engineer) | [Incident.open](/business/nouns/incident/open) | None |
| [Handle a vulnerability report](/workflows/processes/vulnerability-disclosure/handle-vulnerability-report) | 4. Fix the flaw in a Change and verify the fix against the report. | [Engineering Lead](/agents/engineering/engineering-lead) | [Change.create](/business/nouns/change/create) | None |
| [Handle a vulnerability report](/workflows/processes/vulnerability-disclosure/handle-vulnerability-report) | 5. Tell the reporter, credit them if they agree, and close the Thread. | [Security Engineer](/agents/engineering/security-engineer) | [Message.create](/business/nouns/message/create) | None |

## Events
| Direction | When | What happens |
| --- | --- | --- |
| In | On `Thread.created` where `intake = 'security-reports'` | Starts [Handle a vulnerability report](/workflows/processes/vulnerability-disclosure/handle-vulnerability-report) |
| Out | `Message.created` | Raised by step 1 of [Handle a vulnerability report](/workflows/processes/vulnerability-disclosure/handle-vulnerability-report) |
| Out | `Issue.created` | Raised by step 2 of [Handle a vulnerability report](/workflows/processes/vulnerability-disclosure/handle-vulnerability-report) |
| Out | [`Incident.opened`](/business/events/Incident.opened) | Raised by step 3 of [Handle a vulnerability report](/workflows/processes/vulnerability-disclosure/handle-vulnerability-report) |
| Out | `Change.created` | Raised by step 4 of [Handle a vulnerability report](/workflows/processes/vulnerability-disclosure/handle-vulnerability-report) |

## Plays
No Play names this Process.

## Controls
No Control names this Process or a Workflow of it.

## Settings
None.

## Failure
A failed step retries; when retries run out, the Action goes to the [Engineering Lead](/agents/engineering/engineering-lead).

| Step | On failure |
| --- | --- |
| [Handle a vulnerability report](/workflows/processes/vulnerability-disclosure/handle-vulnerability-report) 1. Acknowledge the reporter in the Thread under the disclosure policy. | Times out after 3 days. Goes to the [Engineering Lead](/agents/engineering/engineering-lead). |
| [Handle a vulnerability report](/workflows/processes/vulnerability-disclosure/handle-vulnerability-report) 2. Reproduce the report and record it as an Issue with its severity. | `notReproduced`: The flaw does not reproduce, so the reporter hears why and the Thread closes. Continues at `close`. |

## Loop
No loop: the path is never randomized, because it serves [Vulnerability handling](/systems/legal-and-corporate/floor/vulnerability-handling).

## Code

**Ask**

```text
Turn on vulnerability disclosure
```

**API**

```bash
curl -X POST https://api.sb/leaseline.app/processes/process_1/enable \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"
```

**SDK**

```ts
import { $ } from 'startup-builder'

await $.Process.enable({ process: 'process_1' })
```

**CLI**

```bash
npx startup-builder do Process.enable --json '{"process":"process_1"}'
```

**MCP**

```json
{
  "name": "do",
  "arguments": {
    "code": "return await $.Process.enable({ process: 'process_1' })"
  }
}
```

## Enable
On by default for every Product Template. [Process.pause](/business/nouns/process/pause) stops new Actions; Actions in progress finish.

## Example
A researcher reports an exposed debug route through security.txt. The [Security Engineer](/agents/engineering/security-engineer) confirms it within a day, ships the fix as a [Change](/business/nouns/change), and credits the researcher on the disclosure page.