# Respond to a security vulnerability report from an outside researcher

A triage checklist, severity rating, and replies for a reported vulnerability, from first acknowledgment to fix and disclosure.

- Topic: Software Development
- Framework: RTF
- Level: Advanced
- Tags: Research, Code, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/respond-to-a-security-vulnerability-report-from-an-outside-researcher

## Prompt

```text
Help me respond to a security vulnerability report about my SaaS product.

**The report:** [PASTE IT, removing any customer data or secrets]
**How it arrived:** [security@ email, bug bounty platform, social media, support ticket]
**Our disclosure policy or bounty program:** [LINK or "none"]
**Affected component and stack:** [DETAILS]
**What we've verified so far:** [reproduced / not yet / could not reproduce]

Give me:
1. A triage checklist: reproduce safely in a non-production environment; confirm scope (which tenants, data, versions); check logs for signs of exploitation; decide whether customer data was accessed.
2. A severity rating using CVSS-style factors (attack vector, privileges needed, user interaction, impact on confidentiality, integrity, availability), plus SaaS-specific factors like cross-tenant access. State what would change the rating.
3. Response timeline: acknowledge, triage update, fix, verify, disclose. Give target times for each by severity.
4. Draft replies to the researcher: acknowledgment within 1 business day, a status update, and a resolution note with credit if they want it. Polite, no threats, no promises of payment we haven't agreed to.
5. How to handle common situations: duplicates, out-of-scope or low-value reports (missing headers, self-XSS), researchers demanding payment, and public disclosure pressure.
6. When this becomes a security incident: if exploitation or data access is possible, switch to incident response and assess customer and regulatory notification duties with legal counsel.
7. A short responsible disclosure policy I can publish if I don't have one (scope, safe harbor, how to report, what we commit to).

Do not run or suggest testing against production customer data.
```

## What to fill in

- PASTE IT, removing any customer data or secrets
- LINK or "none"
- DETAILS
- reproduced / not yet / could not reproduce

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.