Skip to content
Declarable

Disclosure policy, security.txt and advisories

A front door for vulnerability reports, and a place to answer them.

The Cyber Resilience Act asks for a way to receive vulnerability reports and a way to tell users about fixes. Declarable drafts the policy and the security.txt that points to it, hosts your advisories, and puts what you choose to make public on one page.

Draft a security.txt, freeSee pricing

Included in Maker, Studio and Fleet.

example.com/.well-known/security.txtExample
Contact: mailto:security@example.com
Expires: 2027-12-11T23:59:59.000Z
Acknowledgments: https://declarable.io/a/example-devices/acknowledgements
Preferred-Languages: en, de
Canonical: https://example.com/.well-known/security.txt
Policy: https://declarable.io/a/example-devices
The security.txt is written by the same function the free tool uses; the organisation is an example.

What it does

Vulnerability disclosure, in 6 parts.

  1. 01

    A disclosure policy to start from

    A draft policy that says how to report a vulnerability to you, what you will do with it and how long it takes. You edit it before publishing.

  2. 02

    security.txt that follows RFC 9116

    The file is checked against RFC 9116 as you fill it in, and served at a stable address you can redirect your own /.well-known/security.txt to.

  3. 03

    Advisories with CSAF files and feeds

    Publish an advisory per vulnerability. Each one gets a CSAF 2.0 file, and your advisories appear in an Atom and a JSON feed that buyers’ tools can follow.

  4. 04

    Thanks for the people who report

    An acknowledgements page lists the researchers you choose to thank.

  5. 05

    One trust centre page

    Your public product pages, advisories, policy and security.txt gathered at one address. Nothing appears there that you have not switched on.

  6. 06

    Share without publishing

    Send a private, read-only link to one product’s record to a customer or an importer, and switch it off when you are done.

How it works

Three steps, the same every release.

  1. 1

    Draft the policy and security.txt

    Answer a few questions about how you take reports. The policy and the file are drafted from the answers.

  2. 2

    Publish when you are ready

    Choose a public name and the pages go live. Until then nothing is public.

  3. 3

    Answer with advisories

    When a fix ships, write the advisory from the finding. The CSAF file and the feeds update with it.

What it does not do

  • It does not receive reports for you. Reports go to the contact you put in the policy and security.txt.
  • It does not validate the CSAF file against every check in the standard. It is written to the standard and you review it.

Questions

Questions about Vulnerability disclosure.

Does the Cyber Resilience Act require a vulnerability disclosure policy?

Yes. Annex I, Part II asks manufacturers to put in place and enforce a policy on coordinated vulnerability disclosure, and to provide a contact address for reporting vulnerabilities.

What is security.txt?

A small text file defined by RFC 9116, served at /.well-known/security.txt, that tells researchers where and how to report a vulnerability to you.

What is a CSAF advisory?

CSAF 2.0 is the OASIS standard format for security advisories. Machines can read it, so your customers’ tools can match your advisories to the products they run.

Can I try it without an account?

Yes. The free security.txt tool drafts the file and a disclosure policy in your browser.

The rest of Declarable

What Declarable is, and what it is not

  • A documentation aid. Declarable prepares drafts and checklists for you to review and edit.
  • Not legal advice. For a legal question about your product, ask a lawyer.
  • Not certification. Nobody at Declarable assesses or signs off your product. You sign your own declaration of conformity.
  • Not an assessment body. Some products need an outside assessment body: an product unless its maker fully applies a harmonised standard or one of the alternatives in Article 32(2), and those on the CRA's Annex III class II and Annex IV lists — the higher-risk product categories, where self-assessment is not enough. Declarable is not one. The scope check asks the questions that point to your category.
  • Not a filing agent. Declarable does not file reports for you. You submit them yourself on the ENISA platform.

Source for the assessment lists and when an outside body is needed: Annexes III and IV and Article 32 of Regulation (EU) 2024/2847 (Cyber Resilience Act), as recorded in legal state 2026.10.13-1.

Start with the free tool. Keep the record when you are ready.

Draft a security.txt, freeSee pricing