# Handle a vulnerability report

URL: /workflows/processes/vulnerability-disclosure/handle-vulnerability-report · Id: `workflow:handle-vulnerability-report`

> Handle a vulnerability report acknowledges a security report within three days, confirms and fixes it, and credits the reporter.

Handle a vulnerability report acknowledges a security report within three days, confirms and fixes it, and credits the reporter.

## Trigger
Runs on `Thread.created` where `intake = 'security-reports'`. Part of [Vulnerability disclosure](/workflows/processes/vulnerability-disclosure), run by the [Engineering Team](/agents/engineering).

## Steps
1. Acknowledge the reporter in the Thread under the disclosure policy.
2. Reproduce the report and record it as an Issue with its severity.
3. Open an Incident when the flaw is being exploited, which starts the regulator clock.
4. Fix the flaw in a Change and verify the fix against the report.
5. Tell the reporter, credit them if they agree, and close the Thread.

## Outputs
- [Issue](/business/nouns/issue)
- [Change](/business/nouns/change)
- [Incident](/business/nouns/incident)

## Example
A researcher reports an exposed debug route through security.txt. The [Security Engineer](/agents/engineering/security-engineer) acknowledges in an hour and reproduces it. The fix ships in a [Change](/business/nouns/change) the next day, and the researcher is credited.