May I test this, whom do I tell, and what happens then?
The Cyber Resilience Act requires in Annex I Part II point 5 a policy on coordinated vulnerability disclosure and in point 6 a contact address for reports, both from 11 December 2027; NIS2 Article 12 governs coordinated disclosure at EU level. The module turns that into the front door of your vulnerability communication: the policy is built from a template library, passes through draft, review and approval and is published at a stable public address. A security.txt per RFC 9116 names the reporting path where security researchers look first, and isidaten checks daily that it is really there. Every report becomes a case file with deadlines fixed on receipt.
Your product domain does not point at the isidaten instance. isidaten generates the security.txt, keeps it and checks daily by fetching whether it is there, matches the profile and is still valid. That proves the contact point is reachable instead of asserting it.
From the policy’s response times three deadlines arise per report: acknowledgement, first assessment, publication. They are fixed on the record and no longer change, even if the policy is amended later. The logged receipt is also the evidence for the start of the CRA’s 24-hour clock.
The approval stamp cannot be adjusted through a form field, and a published version stays reachable until a new version replaces it. The address carries a token per tenant and remains valid permanently, even if the policy was withdrawn in between.
Whoever finds a flaw in your product knows what is allowed, whom they reach and when they get an answer. And you can prove that it is true.
Schedule a no-obligation demo – we will show you the module with your own use cases.
