If you cannot find a security contact, check for a security.txt file, look the organization up in disclose.io's directory, and try to reach the actual security team rather than whoever answers first. If all that fails, consider a national or sector CERT or a coordinator such as CISA.
Step 1: look for security.txt
Fetch /.well-known/security.txt on the exact host, then /security.txt. RFC 9116 says the file applies only to the host it is served from, so try the main domain and the app domain separately. Check the Expires date, since stale data should not be used, and read the Policy field if there is one.
Step 2: check directories
disclose.io offers a lookup that maps an asset to its security contact, its disclosure program and its safe harbor status, plus a searchable directory of programs. It is a quick way to learn whether a program exists before you spend an hour searching.
Step 3: ask for the right person
The OWASP cheat sheet advises making reasonable efforts to reach the security team, and asking for the right staff member rather than sharing details with whoever answers first, especially on social media. A short message that says "I have a security issue to report, who should I send it to?" shares nothing sensitive and often gets routed well.
Step 4: use a coordinator
When the organization does not respond, OWASP suggests a national or sector CERT. CISA runs a coordinated process with a single intake channel, vendor contact and CVE decisions. Read its page first to see whether the issue is in scope. Our post on when to use CISA coordination has the stages.
What to avoid
- Posting the details publicly to get attention.
- Sending proof of concept code to a generic sales address.
- Demanding payment before explaining the issue. OWASP says not to.
- Testing more deeply to "prove" it. Stop once you have shown the problem exists.
Keep a record
Note dates and channels you tried. If you later publish, a clear record of reasonable attempts supports your timeline. Our guide to reporting a vulnerability covers the report itself.
Quick check
How long should I wait before escalating?
There is no universal number. Pick a period, tell the organization in your first message, and follow it. See disclosure deadlines for common approaches.
Is it fine to email the CEO?
It can work, but it spreads details beyond the people who can fix them. Ask for the security team first.
Sources
- IETF: RFC 9116, security.txt
- disclose.io: lookup and directory
- OWASP: Vulnerability Disclosure Cheat Sheet
- CISA: Coordinated Vulnerability Disclosure process
Last reviewed: 19 October 2026.
