Skip to content
EU Rules Finder
English (Language)

Coordinated vulnerability disclosure policy template and security.txt generator

The Cyber Resilience Act requires every manufacturer of a product with digital elements to have a coordinated vulnerability disclosure policy and a contact address for vulnerability reports. Fill in your details to get the policy text and a matching security.txt file for your website. Nothing you type leaves your browser.

Checked against the sources on 2 November 2026

Product names, models or "all our products with digital elements".
An email address or the https address of a web form: your single point of contact (Article 13(17)).
An https page on your website, for example https://example.com/security.
For the Canonical line of security.txt.
A whole number from 1 to 30.

Your policy

Still to fill in

  • Add the company name.
  • Add an email address or an https web form address for reports.
  • Add the https address where the policy will be published.
  • Add the date of the policy.

Coordinated vulnerability disclosure policy of TO COMPLETE

TO COMPLETE welcomes reports of potential vulnerabilities in its products, including in third-party and open-source components they contain. This policy says how to report one and what we do with it.

Scope

This policy covers: TO COMPLETE.

How to report

  • Report to: TO COMPLETE. This is our single point of contact for vulnerability reports.
  • Please include the product and version, a description of the issue, the steps to reproduce it and any proof of concept, and how we can reach you.
  • You may report in English or in the language of your choice; you may stay anonymous, though we then cannot keep you informed.

What we do

  • We acknowledge your report within 5 working days and keep you informed until it is resolved.
  • We assess the report, and address and remediate a confirmed vulnerability without delay, in relation to its risk.
  • We agree a disclosure date with you. Please do not disclose the vulnerability before a fix is available or that date has passed.
  • Once a security update is available, we publish information about the fixed vulnerability: a description, the products affected, its impact and severity, and how users can remediate it. Where the security risks of publication outweigh its benefits, we may delay publication until users have had the possibility to apply the update.
  • Where the vulnerability is in a component made or maintained by someone else, we report it to them.
  • With your agreement, we credit you when we publish.

About this policy

Published at TO COMPLETE. Last updated TO COMPLETE.

security.txt

Publish this file at /.well-known/security.txt on your website. It expires one year less a day after the date of the policy (RFC 9116 asks for less than a year): renew it before then.

security.txt needs a readable contact and date; it appears here once both are filled in.

The policy is written in English, the language most reporters use; translate it if your users need it. Entries that cannot be read print TO COMPLETE. It is a template, not legal advice, and does not show that a product meets Regulation (EU) 2024/2847.

The whole CRA file set, with this policy, the vulnerability handling and reporting procedures, technical documentation and the EU declaration of conformity in 9 languages (paid)

What the Cyber Resilience Act asks

  • Put in place and enforce a policy on coordinated vulnerability disclosure (Annex I, Part II, point 5).
  • Make it easy to report vulnerabilities, including by giving a contact address for reports (Annex I, Part II, point 6).
  • Once a security update is available, publish information about the fixed vulnerability: a description, the products affected, its impact and severity, and how users can remediate it; publication may be delayed where its security risks outweigh its benefits (Annex I, Part II, point 4).
  • Designate a single point of contact so users can reach you directly and rapidly, including to report vulnerabilities (Article 13(17)), and name it, with where the policy can be found, in the information for users (Annex II, point 2).

Dates

The vulnerability handling requirements of Annex I, Part II apply from 11 December 2027. The duty to report actively exploited vulnerabilities and severe incidents applies from 11 September 2026 (Article 71(2)), and a published contact for reports helps you hear of them in time.

What security.txt is

A short text file at /.well-known/security.txt that tells security researchers where to report (RFC 9116). It needs a Contact line and an Expires date; the generator adds the policy address, the preferred language and, with your website, the Canonical line. Web addresses in it must use https.

What the generator does not do

It does not set up a reporting channel, triage reports or decide whether something must be reported under Article 14. For the reporting deadlines use the CRA reporting register; for the software bill of materials the SBOM generator; to see where you stand, the CRA readiness check.

Nothing you type is stored or sent: reloading the page clears it. Copy or download the files to keep them.

Sources