Disclosure programme

Somewhere for a stranger to send it

If someone finds a security problem in your product this week, where do they send it? For most organisations the honest answer is nowhere in particular. We will run the missing half for you, and it costs nothing.

What you get

• A page carrying your policy, in your name, that we host and keep up.
• One line for your own security.txt pointing at it, so a reporter finds it where reporters look first.
• Triage. Reports arrive to us. We read them, discard the noise, and pass you only what is real — with enough detail to act on.
• A first response to the reporter within a period you set, so nobody is left guessing.

What it costs, and what it does not do

Nothing, and there is no contract. This is deliberately not a test: nobody touches your systems, nothing is scanned, and no access is asked for. It is a front door and someone standing behind it.

We do it because it is the honest way to begin a relationship with a company that has never heard of us, and because the alternative — a stranger with a finding and nowhere to send it — serves nobody.

Why it is worth ten minutes

A published reporting channel is an ordinary control, and it increasingly appears on the questionnaires customers send before they buy. In the European Union it stops being optional: under the Cyber Resilience Act, manufacturers must publish a coordinated vulnerability disclosure policy and a security contact, with the remaining obligations arriving on 11 December 2027. If you sell software or connected products into the EU, you will need one.

And the narrow point that has nothing to do with compliance: without a route, the person who found the problem decides what to do about it without you. Most do nothing. Some post it. A few email whoever they can find, where it is read as spam and deleted. You do not get a say in which. The longer version of that argument is here.

How it starts

1. Tell us the name you want shown on the page.
2. We send back the policy text to approve — your wording, your call.
3. You add one line to your security.txt. That is the whole integration.

You can see exactly what it looks like before you ask for one, because we run our own on it: the page strangers use to report a problem in this platform is the same intake a client gets, with our policy on it instead of theirs. The line in our security.txt that points at it is the line you would add to yours.

And if you would rather start smaller: send us a domain and we will read back what it already shows a stranger — the reporting route, the certificate, SPF and DMARC, the response headers. Strictly passive, nothing scanned or probed, and yours to keep either way.

Exception Security also runs private, invitation-only security testing, where identity-verified researchers work on a scope and a window you set and you are billed only for findings you accept. That is a separate thing you may never need, and this page is not a route into it — a disclosure programme is useful on its own terms. If you are weighing the two, the private programme is described here.