To elaborate just a wee bit on what Thomas said, there are many, many startups which transact real money (via, e.g., taking credit cards on their website, even

To elaborate just a wee bit on what Thomas said, there are many, many startups which transact real money (via, e.g., taking credit cards on their website, even if via one of the methods where it doesn't get POSTed at their server) which don't go as far as saying "Here's the address you can talk to if you find something critical. We WILL get back to you." Startups without this page have often found out about security vulnerabilities via posts at third party sites. Regardless of the moral righteousness of that, that is for better or worse the cultural expectation of many security researchers. Also, since it's on your website, you're going to have a bit of tension in serving the "Needs to report a security vulnerability" audience at the same time as you're supporting non-technical customers who care about "security" for business reasons. Those are very different conversations. I had one with a stakeholder at a large organization who was worried about the physical security of my servers recently. I told him that they were in a professionally managed datacenter, behind a gate, which required a keycard to access, and that if I showed up at the door they would turn me away because that isn't the model at my host. His response was, I kid you not, "Oh, wow, you're Fortune 500? Sorry, I just have to ask that because a lot of our vendors keep the server in their home or office."