Vulnerability reports

Your trust center has a public Report a vulnerability form. Reports that visitors send arrive under Security, then Reports, in the admin sidebar. This is a record and an inbox, not a ticketing system: you triage and reply from your own email, and archive a report here once you’re done with it.

How a report arrives

A visitor opens the form from the Home tab or the Security tab. It’s on while the Vulnerability Disclosure switch on the Dashboard is on. They enter every one of these, and all are required:

• Summary, up to 200 characters.
• Details, up to 5000 characters.
• Affected asset or URL, up to 2000 characters.
• Suggested severity: Not sure, Low, Medium, High or Critical.
• Steps to reproduce, up to 5000 characters.
• Your name and Your email.

When they submit:

1. The report is saved and appears in your admin.
2. Your Security reports address (see Settings) gets an email called “New vulnerability report: <summary>”, with the details. Replying to it reaches the reporter.
3. The reporter gets an email, “<your company> received your security report”. It confirms when the report was received and doesn’t repeat what they wrote.

Read reports

The page has two tabs: Open and Archived. Each row shows the date submitted, the title and affected asset, the reporter, the suggested severity and the start of the description.

Choose a row to open all of its fields: reporter name and email, suggested severity, when it was submitted, the affected asset, the description and the steps to reproduce. The reporter’s email is a link that opens a new message to them.

The severity shown is the one the reporter chose. Notice Labs doesn’t assess it.

Archive and restore

Choose Archive on a row, or in its dialog, when you’re done with a report. It moves to the Archived tab. Choose Restore there to bring it back to Open. Archiving doesn’t delete anything, and there’s no delete for reports.

Nothing in the admin sends a reply or changes the reporter’s status. Handle the report from your inbox.