Let's start with what's bad about me reporting such a thing:

1. Most importantly: there is a very high probability that you (or a close supplier) have a serious problem. I do not suffer from boredom (quite the opposite), so I won’t come to you with trivialities. It’s usually something like you having 300,000 patient reports publicly accessible.
2. I will hold you to high standards. If I report something to you, I'm investing my spare time because I believe the issue is serious enough to warrant it. I won’t go away until I see a proper response. I will ring bells to get your attention — starting small, but escalating quickly if needed.
3. It is very likely that relevant authorities will be informed in parallel. I believe authorities can only act if they are aware of problems. So, I inform them — even if they don’t act in most cases.

2/9

Let's continue with what's good about me reporting such a thing:

1. Fixing the issue will most likely save you money and prevent far bigger trouble in the future.
2. I don’t want any money. My motivation is civic responsibility, not income. So you don’t need to open your wallet.
3. I didn’t “hack” your system. Unless you explicitly pay me for testing, I won’t attempt to hack anything. Your problem is most likely an obvious and embarrassing one — which is good, because that usually means it's easy to fix.
4. I don’t want to hurt you. My goal is to fix the problem, not to damage your reputation. This might happen anyway if you don't fix the problem on your side.

3/9

What you shouldn’t do?

Some actions will only cause you more pain in the long run:

1. Ignore me: As mentioned above, I will use increasingly large and loud bells to get your attention. This will draw more eyes to your problem. Unfortunately, ignoring me is the default I see most often.
2. Threaten me: Attempting to silence me with threats (typically from your lawyers) won’t improve my mood nor resolve anythig. It’s very unlikely I’ll feel seriously intimidated.
3. Ask me to sign an NDA: I report what I report. I won’t sign an NDA. There’s no upside for me — it only restricts my ability to push for a fix.
4. Refer me to a bug bounty platform: These often require signing NDAs (see above), and I have no interest in joining yet another platform. I neither want nor need money. Bug bounty programs don’t help my mission — unless they work via something as simple as sending an email to a listed address.

4/9

What can you do beforehand?

There’s one thing you can do in advance that will make such events much less painful:

➡️ Publish a security.txt file compliant with RFC 9116 at all your services.

Having this file means:

• I assume (initially) that you take security seriously.
• I’ll use the contact you specified to alert you.

You save me time and effort — which I appreciate. Also, this may prevent me from getting involved at all because someone else informed you and you’ve already fixed the problem. As I said: unless you pay me, I’m not hunting for vulnerabilities. In most cases, I get involved because a security researcher needs help getting the issue fixed.

The other thing you can do is to prepare procedures to work with such disclosures. Make sure that any possible input channel of your organization knows how to proceed if such a disclosure arrives. It won't do any good if you have a security.txt but the message gets ignored because one person is on vacation.

5/9

So how should you reply?

I recommend that your reply addresses the following points:

1. Confirm receipt and establish a channel or contact for further communication.
2. Reflect your view of the analysis: severity, impact, scope.
3. Describe the next steps and a timeline.

6/9

Example of a near-perfect reply

Such a message would make me very happy:

Thank you for your disclosure. We have opened ticket #123456 to track this issue. You can contact us at incident@example.org for status updates or to provide new information.

We believe this vulnerability affects all customers using service X, especially group Y. We have identified the core problems as Z1 and Z2. We currently rate the severity as (your rating).

To address this, we need to resolve Z1 and Z2 by (your measures). This will take some time, and we can’t give a fixed timeline yet. However, we intend to implement a mitigation in service X within (number of days).

Unless you set an unreasonable timeline, I’ll leave you alone for that period.

7/9

My experience with such disclosures

Unless you’ve planned ahead, you very likely will fail to meet my expectations.

I hate to say it, but that’s the norm — not the exception.

On the other hand, all the security issues I’ve reported were eventually fixed. I have, to date, never used the loudest bell at my disposal. But your bad —or non-existent— initial reply usually makes the process more painful than necessary for both of us.

8/9

Footnotes

• My disclosure may trigger other legal implications for you. You may need to inform customers, shareholders or other relevant groups. That is your task. I epxect you to know and follow your obligations.
• You canot prevent me from writing a publicly available after action report. But you have great influence on how professional you look in it.
• I deeply dislike organisations that fix the problem, but do not communicate (neither to me or the public).

9/9