Coordinated vulnerability disclosure policy
Where finders report, what you promise back, and on what timeline.
- Scope: Acme Desktop Agent 3.x
- Report to: security@acme.eu
- Acknowledge within: [TO BE DECIDED]
- Safe harbour: yes
Compliance is not what you did.It is what you can prove.
Send us an SBOM. We watch every component, start the 24-hour clock when one is being exploited, and keep a record your auditor can verify.
Acme Desktop Agent
3.4.0 / 412 components
CVE-2021-44228Known exploited
org.apache.logging.log4j:log4j-core
2.14.1 to 2.15.0
CVE-2022-42889This week
org.apache.commons:commons-text
1.9 to 1.10.0
Early warning due in21h 14m
Reporting obligations start in 17 days.
The audit you paid for was out of date before you signed it.
A consultant reads your product for two weeks and hands you a PDF. It is accurate on the day it is written. Then you merge a dependency bump, and the document quietly stops describing your product.
An enterprise scanner tells you about a vulnerability. It does not tell you whether that vulnerability reaches your product, it does not run a 24-hour clock, and it does not produce anything a market surveillance authority would accept as a record.
Both of them give you one link. The Regulation asks for the whole chain.
- 01
What you ship
- 02
What is wrong with it
- 03
What you decided
- 04
When you told them
- 05
That you can prove it
Non-compliance with the essential requirements and the vulnerability obligations reaches EUR 15 million or 2.5% of worldwide turnover, whichever is higher.
What is wrong with it
Three sources, checked on a schedule that matches how fast they move.
Components are matched against OSV every night. The CISA catalogue of actively exploited vulnerabilities syncs every six hours, and a new match is flagged against it the moment it lands, not at the next sync. EPSS tells you which of the rest is worth this week.
- OSV.devNightly
Advisories for every ecosystem your build actually uses, matched by package URL and version range rather than by name.
- CISA KEVEvery 6 hours
The catalogue of vulnerabilities being exploited right now. A new match is checked against it on the same run, not at the next sync.
- FIRST EPSSDaily
The probability that a vulnerability gets exploited in the next 30 days. It decides what is worth this week among everything that is not on fire.
A vulnerability the database has withdrawn does not appear. Sending you to fix something the source itself no longer stands behind is worse than saying nothing.
What you decided
We will never tell you that you must report.
CISA says a component is being exploited. Whether that reaches your product, and whether it triggers your obligation, is a judgement only you can make. We hand you the signal, the clock and the record. The call stays yours, and so does the wording.
Marking a finding "not affected" requires a reason. An auditor will read it. A product that lets you close a vulnerability in silence is selling you the feeling of compliance.
When you told them
The clock starts when you say it starts, and it cannot be moved.
Opening a case fixes all three deadlines at once: the early warning, the detailed notification, and the final report. Reminders go out before each one, to the people on the account, in their own time zone and in UTC side by side.
- 24h
Early warning
That you know. Minimal facts, sent to your CSIRT and to ENISA.
- 72h
Detailed notification
What it is, what you know about severity and impact, what mitigation exists.
- 14d
Final report
The description, the fix, and the measures. Fourteen days for a vulnerability, one month for an incident.
Deadlines are stored as columns, not recalculated on every page load. A deadline that depends on which version of our code is running is not a deadline.
That you can prove it
Every step is chained to the one before it.
Each entry carries the hash of the entry before. Change an old record and every hash after it stops matching. Export the journal and your auditor can verify the whole chain without trusting us, without an account, and without our servers being up.
Break it and watch.
This is the real structure, not a picture of one. Edit any entry below. Every hash after it stops matching, and the chain reports itself broken.
Chain intact
| Seq | When (UTC) | Who | What happened | Hash | Actions |
|---|---|---|---|---|---|
| 1 | Sep 11, 08:00 | ingest_token:ci | 412 components received from CIsbom.received | f7276a12e643e47cb655b8ea4917baa67c8b0ad2f2f2b82aae5ebc55daea68e7 | |
| 2 | Sep 11, 08:06 | system | CVE-2021-44228 flagged as actively exploitedalert.sent | 3e447face7d5a30451e12cb9403d828eee184d1a88b9653956ca8cc805804736 | |
| 3 | Sep 11, 08:41 | anna@acme.eu | Case opened, 24-hour clock startedreport.opened | 15f60371bae000581ed61c381fc15d0b6ec057d9bf3ad5a43436960b0e24273a | |
| 4 | Sep 12, 06:12 | anna@acme.eu | Early warning submitted, 2h 29m before the deadlinereport.stage.submitted | 1791336be0b2b9bddca27bfced2e960f143fca82e1544ac7eaee2b955efb54a0 | |
| 5 | Sep 14, 05:03 | anna@acme.eu | Detailed notification submittedreport.stage.submitted | 1ee376796fcabfb686e9825aa3a5f9044cc11009e18bd1f5a0e2d7cbe5d2cd96 |
Root hash in the export
1ee376796fcabfb686e9825aa3a5f9044cc11009e18bd1f5a0e2d7cbe5d2cd96Your auditor runs the same check on the exported file. That is the point: the record does not ask anyone to take our word for it.
A missed deadline is recorded exactly as it happened. A product that hides one is selling reassurance, and reassurance is worth nothing in the room where this gets checked.
The morning view
Red means today. Nothing else is red.
Fifty critical findings in transitive dependencies is the normal state of any product, and colouring them red teaches you to stop looking. Red is reserved for a component someone is exploiting right now.
Acme GmbH
Reporting obligations have applied since 2026-09-11.
Open reporting cases
Deadlines are shown in your time zone.
Products
Red means a component is listed by CISA as actively exploited. Nothing else is red.
| Product | Status | Known exploited | Critical / High | Open |
|---|---|---|---|---|
| Acme Desktop Agent | Action today | 1 | 2 / 6 | 21 |
| Acme CLI | Scheduled work | 0 | 1 / 2 | 9 |
| Acme Gateway (firmware) | Scheduled work | 0 | 0 / 1 | 4 |
| Acme Cloud outside CRA scope | Nothing urgent | 0 | 0 / 0 | 0 |
That is the product rendering above, not a picture of it. The same components, the same traffic-light rule, the same data shapes. A drawing of a dashboard drifts from the dashboard within a week.
What you hand over
The paperwork, generated from what you already told us.
Four documents the Regulation expects you to have. Built from your product registry, not from a blank template you fill in twice.
security.txt
The first place a finder looks. Published with an expiry date, because a stale one points at an address nobody reads.
- Contact: mailto:security@acme.eu
- Policy: https://acme.eu/security
- Preferred-Languages: en
Vulnerability handling and update policy
How a report reaches you, who triages it, how fast a fix ships.
- Supported until: [TO BE DECIDED]
- Security updates: separate channel
- Delivery: signed, over TLS
Technical documentation (Annex VII)
A skeleton with your data filled in and every remaining decision marked. It says so on the first page.
- 1. Product description
- 2. Risk assessment
- 3. Vulnerability handling
- 4. Standards applied
- 5. Conformity assessment
Where the decision is yours, the document says [TO BE DECIDED] instead of a plausible number. A document that decided your response times for you is one you sign without reading, and then hear about from whoever quotes it back at you.
- 10,000components per SBOM, parsed in under a tenth of a second
- 3public sources, none of them behind a key
- 24hclock, started by you and recorded to the minute
- 0lines of your source code we can read
Built for
- Downloadable software sold in the EU: desktop apps, CLI tools, developer tooling, mobile apps
- Commercial plugins and extensions for other platforms
- Connected devices and the firmware that ships with them
- Teams of two to twenty, with nobody whose job title contains the word security
Not for
- Standalone SaaS, which is outside the scope unless the remote processing is integral to a product
- Non-commercial open source, which is outside the scope; commercial stewards fall under a lighter regime
- Enterprises that already run Snyk or Anchore and have counsel on retainer
- Anyone looking for a certificate rather than a process. There is no certificate.
What this does not do.
Said here rather than discovered in month three.
- 01
We do not file to ENISA for you.
We assemble the package with the fields filled in and run the deadlines. Whether the single reporting platform exposes an API is not settled yet. When it is, direct submission is the obvious next step. We would rather write this sentence than imply an integration that does not exist.
- 02
We do not scan your code.
You generate the SBOM in your own build. It lists what you ship and nothing else. It is encrypted at rest with a separate key per object, because a dependency map of someone else’s product is an attack plan if it leaks.
- 03
Our templates are not legal advice.
They are drafts built from your registry, and every page says so. Have a qualified adviser read them before you rely on them.
- 04
We do not decide that you must report.
That judgement is yours, and the Regulation puts it on you rather than on your vendor. We make it fast to make and impossible to forget.
Three ways teams handle this today.
A spreadsheet
Free until it is not
Works right up to the morning someone asks when you learned about a vulnerability and the honest answer is a cell somebody edited last March.
A consultant
EUR 6,000 to 12,000 per audit
Real expertise, delivered once. Correct on the day it is written, and silent for every release after it. You buy it again next year.
An enterprise scanner
From EUR 20,000 per year
Excellent at finding vulnerabilities. Built for a security team you do not have, priced for a company you are not, and it does not produce a record of what you did about them.
This
From USD 149 per month
The whole chain, from the SBOM to the exported record, for teams where the person handling compliance also ships the product.
Pricing
Monthly, no annual commitment. Every plan includes the full workflow. The difference is how many products you cover.
Starter
$149 /mo
Up to three products.
- 3 products
- 2 seats
- Full reporting workflow
Growth
$299 /mo
Up to ten products, three seats.
- 10 products
- 3 seats
- Full reporting workflow
Partner
$499 /mo
For consultants: white-label reports across client products.
- 50 products
- 10 seats
- White-label reports
Start free with one product and the whole workflow. A trial you cannot finish tells you nothing.
Questions
The seven that come up in every conversation, answered the way we answer them on a call.
Does the CRA actually apply to us?
Manufacturers, importers and distributors of products with digital elements sold in the EU, including companies established outside the EU. If you sell downloadable software or a device in the EU it very likely does, including if you are established outside the EU. Standalone SaaS and non-commercial open source are outside the scope. We ask you to classify each product, and when you mark one out of scope we stop asking you for compliance work on it.
What changes on 2026-09-11?
From 2026-09-11, manufacturers must report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform: early warning within 24 hours, a detailed notification within 72 hours, and a final report within 14 days for a vulnerability or one month for an incident. This applies to products already placed on the market.
And by 2027-12-11?
From 2027-12-11, the Regulation applies in full: essential requirements (Annex I), SBOM, a vulnerability handling process, technical documentation, conformity assessment and CE marking.
How fast do we hear about an actively exploited vulnerability?
The CISA catalogue syncs every six hours. A newly matched vulnerability is checked against the catalogue we already hold the moment it lands, so a component that is being exploited is flagged on the same run rather than at the next sync. The alert goes out by email and webhook within minutes of that.
What happens to our SBOM?
It is encrypted before it reaches storage, with a separate key per object wrapped by a master key we can rotate without touching your data. Nobody browses a bucket. A dependency map of your product is an attack plan against you, and it is treated as one.
Can our auditor check the journal without an account?
Yes, and that is the design. The export carries every entry plus the root hash. Verifying it needs the file and a SHA-256 implementation. It does not need us, our servers, or our continued existence.
What if we miss a deadline?
The journal records it as it happened, and the export shows it. We considered making that softer and decided against it: a record that flatters you is not a record, and the person who will read it knows the difference.
Send one SBOM.
We will send back what is exploitable in your product today, what to upgrade to, and what the Regulation expects you to have by each date. No account, no card, no call.
One command: syft your build, one POST, and the report comes back the same day.
This material is generated from your own product data and public sources. It is not legal advice. Have a qualified adviser review your compliance documentation before you rely on it.