Share a security pack with buyers

Buyers increasingly ask how you handle the security of what they buy. On paid plans, each product has a buyer security pack: one page you send them, in English, French or German, with what Provetry records about the product and nothing you did not choose to share.

What the page shows

• the product, its CRA category and the end of its support period;
• its supported releases, and if you wish the SBOM of the latest one (CycloneDX);
• how many vulnerabilities you assessed as not affecting it or fixed, with the VEX feed (OpenVEX);
• your correction times over the last 12 months, against your targets;
• how to report a vulnerability, with links to your disclosure policy and security.txt on your website;
• the published advisories, and a link to the public security page when it is open.

It never shows your open vulnerabilities, your notes, your drafts or your reporting cases.

Share it

1. On the product, open Buyer security pack.
2. Choose who can open it: anyone with the secret link, or also from the product’s public security page.
3. Tick Include the SBOM only if you want buyers to download the full list of components: it also tells an attacker what to look for.
4. Choose how long the link is valid (30 days, 90 days, a year, or no limit), then Save.
5. Copy the link and send it. The page counts roughly how many times people opened it, and when last (link previews and mail scanners are left out).

Make a new link stops the current one at once: use it when a link went further than you meant. A new link is also made when you leave the public mode (the old one was on a page search engines read) and when you open an expired link again. Choosing Nobody closes the page; the same link works again if you open it later, unless you make a new one. The page is never indexed by search engines. The link to your disclosure policy points to your own website.