Your disclosure policy and security.txt
The policy the CRA asks for, written from your answers, and a security.txt to publish and renew before it expires.
The CRA asks every manufacturer to have a coordinated vulnerability disclosure policy and a contact point for reports. Provetry writes both from a few answers, under Disclosure policy (paid plans; owners and admins).
- Give your website and where to report (a security@ address or a reporting form).
- Choose the path of the policy on your site, and optionally an OpenPGP key and an acknowledgments page.
- Set your commitments: acknowledge within, first assessment within, publish an advisory after.
- Decide whether to commit not to take legal action against good-faith research. It is a legal commitment: have your counsel read it.
- Choose the language of the policy: English, French or German.
- Click Write the policy and security.txt.
The policy is reviewed by a certified security expert before it appears; you can see the draft meanwhile. It lists your products and the end of their support period, from their profiles.
security.txt
The security.txt file is ready to publish at /.well-known/security.txt on your website. It expires in less than a year, as RFC 9116 asks: write it again from this page before that date and publish the new file. Once you publish advisories, it gets a CSAF line pointing to them.
Still stuck? Write to us at hello@provetry.com.