Free tool
Vulnerability disclosure policy generator
Answer a few questions and get a coordinated vulnerability disclosure policy for your products, ready to publish on your website. In English, French or German.
Runs entirely in your browser: nothing you type or open is sent to us or stored.
A starting point, not legal advice: have it read by your lawyer, especially the safe-harbour paragraph.
What the CRA asks
Annex I, Part II of the Cyber Resilience Act asks every manufacturer to put in place and enforce a policy on coordinated vulnerability disclosure, to give a contact address for reporting vulnerabilities, and to share information about fixed vulnerabilities with users, in a public advisory. These obligations apply from 11 December 2027; the duty to report actively exploited vulnerabilities to ENISA applies since 11 September 2026.
The policy only works if people can find it: link it from your security page and from the Policy field of your security.txt file.
Other free tools
- security.txt generator and checker
Write the RFC 9116 file that tells researchers where to report a vulnerability, or check the one you have.
- CVSS 3.1 calculator
Score a vulnerability from its eight base metrics, or paste a vector to read it.
- CVSS 4.0 calculator
The newer version of CVSS, scored with FIRST’s reference calculation: base metrics, or any vector pasted.
- EPSS score lookup
How likely a vulnerability is to be exploited in the next 30 days: today’s score from FIRST, for up to 30 CVEs at once.
- SBOM generator
Turn your lock files into a CycloneDX or SPDX SBOM: npm, pnpm, Yarn, Python, Go, Rust, Java, .NET, PHP and Ruby.
- SBOM viewer and checker
Open a CycloneDX or SPDX file: its components, and what the CRA expects that is missing.