Skip to content
StartupBuilderby Startups.Studio
Workflows
Changelog
All Processes

Handle a vulnerability report

Handle a vulnerability report acknowledges a security report within three days, confirms and fixes it, and credits the reporter.

Trigger

Runs on Thread.created where intake = 'security-reports'. Part of Vulnerability disclosure, run by the Engineering Team.

Steps

  1. Acknowledge the reporter in the Thread under the disclosure policy.
  2. Reproduce the report and record it as an Issue with its severity.
  3. Open an Incident when the flaw is being exploited, which starts the regulator clock.
  4. Fix the flaw in a Change and verify the fix against the report.
  5. Tell the reporter, credit them if they agree, and close the Thread.

Outputs

Example

A researcher reports an exposed debug route through security.txt. The Security Engineer acknowledges in an hour and reproduces it. The fix ships in a Change the next day, and the researcher is credited.