Offer a plain email address as the baseline and add a web form or platform only if you can staff it. Email is what researchers expect and what security.txt points to. A form helps with structure and spam. Whatever you choose, it must reach a monitored queue, not one person's inbox.
The three common options
Shared mailbox. Simple and familiar. The downsides are spam, attachments that need careful handling, and no built in tracking.
Web form. You control the fields: affected URL, steps, impact, contact. You can add rate limiting and a spam check. The downside is that some researchers dislike forms, and a broken form silently loses reports.
Hosted reporting feature on your code platform. Private reporting inside a repository workflow keeps the report, discussion and fix together. It suits open source and teams already living there. It assumes the reporter has an account.
How they compare
| Question | Web form | Platform feature | |
|---|---|---|---|
| Setup effort | Minimal | Moderate | Low if you use the platform |
| Structured data | No | Yes | Partly |
| Spam control | Weak | Good | Good |
| Tracking | Manual | Possible | Built in |
| Researcher friction | Lowest | Medium | Medium |
Rules that apply to any choice
- Publish it where researchers look. Use a security.txt file at the standard location. RFC 9116 makes only Contact and Expires mandatory, and the file is served over HTTPS as plain text.
- Send an acknowledgement automatically, then a human reply within the time you promise.
- Test monthly. Send a fake report from an outside address and confirm someone sees it. Mailboxes and forms break quietly.
- Plan for sensitive content. Reports can contain exploit details. Restrict who can read the queue and do not forward reports into general chat channels.
- Offer encryption if you can handle it. If you list a key, you must be able to decrypt. See do you need a PGP key for security reports.
Pick by team size
A tiny team: one mailbox with a rotation and a calendar reminder. A mid sized team: mailbox plus a form that creates a ticket in a private project. A team with a bug bounty program: use the platform's intake and keep the email address live for people outside it.
Sources
Quick check
Do we need a form if we have email?
No. Add one only when the volume of low quality reports makes structure worth the effort.
Who should read the queue?
A named rotation of at least two people, so holidays do not stall replies.
Last reviewed: 19 October 2026.
