Establish a responsible disclosure process for security researchers

A responsible disclosure process, beyond just a security.txt file, defines the actual scope of what researchers can test, your response timeline, and whether you offer any recognition or reward, giving a genuine security researcher a clear, safe path to report a real issue privately.

Without a clear process, a well-intentioned researcher who finds a real vulnerability may not know how to report it safely, or may default to public disclosure, which is worse for everyone than a private, coordinated fix.

How to do it

1. 1
   Define your actual scope

   What systems or areas are genuinely fair game for security testing, and what is explicitly off-limits.
2. 2
   Set a real response timeline commitment

   How quickly you will acknowledge a report and provide a genuine update.
3. 3
   Decide on recognition or reward

   Even a simple public thanks or a small reward meaningfully encourages responsible reporting over public disclosure.
4. 4
   Publish this clearly, linked from your security.txt

   Make the actual process genuinely easy to find for a researcher who wants to do the right thing.