Skip to content

Guides

Handle a customer who reports a security vulnerability

A vulnerability report in the support inbox is not a normal ticket. Handle it quickly, privately and with care for the person who sent it.

Last reviewed

Acknowledge within hours and say thanks

Tell the reporter you received it, that you take it seriously and who will follow up. Do not argue about severity in the first reply.

Move it out of the general queue

Forward it to whoever owns security, mark the ticket private and restrict who can see it. Do not discuss it in public channels or shared threads.

Do not ask for more than you need

Ask only for the steps to reproduce and the affected area. Do not ask them to test further, and never threaten legal action over good-faith reports.

Tell them what happens next

Give a realistic timeline for an update. Even a short note that you are still investigating keeps the reporter from going public.

Close the loop and record it

Tell the reporter when it is fixed, thank them again and keep an internal record. Add a security contact to your site so the next report goes to the right place.

Questions

Should support triage security reports?

Support should recognise them and pass them on at once. The security owner should triage and decide.

Should we reward reporters?

That is a policy choice. At the least, thank them and, if you can, credit them once the fix ships.

What if the report is wrong?

Reply politely with what you found and why it is not a vulnerability. A clear explanation keeps the relationship.

Written by Flatdesk, a help desk for small support teams at one flat price per agent. Try it free for 14 days, no card.