4 ms·
Why not have a specific web form on your contact page that says "report a bug" that takes 1) contact email, 2) example compromised data (if any), 3) steps to re
by wdh505 5y ago
Why not have a specific web form on your contact page that says "report a bug" that takes 1) contact email, 2) example compromised data (if any), 3) steps to reproduce, and 4) description of the bug.
A contact page that has a form to be filled out with an auto response stating that there is no bounties paid out, but all bug reports are read.
Any downsides? Full disclosure, I have not maintained the code on a website or server before.
- tptacek 5y agoYou need to answer arbitrary, informal emails to `security@` no matter what. You can't impose a protocol on top of that. Serious security researchers can reasonably blow off coordination with you if you get fussy with it.