Reply to a security researcher quickly, say thank you, confirm you have the report, and state when you will triage it. Do not argue about severity in the first message and never threaten legal action. A calm first reply decides whether the researcher keeps working with you.
What the guidance asks for
The OWASP cheat sheet gives a short list for the response side: acknowledge reports promptly, say when triage will happen, ask for clarification where needed, confirm the issue, set a fix timeline, and keep the researcher updated even when there is no firm date.
A plain template
Adapt this wording:
Thanks for the report. We received it on the date shown and have passed it to our security team. We will confirm whether we can reproduce it by a date we will give you in this message, and we will write again at that point even if the answer is not final. If we need more detail, we will ask. Please keep the details private until we have agreed a date.
Fill the date in. A vague "soon" is the most common reason researchers escalate.
What not to say in message one
- Do not dispute impact. You have not reproduced it yet.
- Do not ask who the researcher works for.
- Do not refer to terms of service or legal action. OWASP advises against threatening legal action.
- Do not promise a reward or a fix date you cannot control.
- Do not forward the full report to people who do not need it.
Updates matter more than speed
A fast acknowledgement followed by silence is worse than a slow acknowledgement followed by honest updates. Set a rhythm, for example every two weeks, and keep it. Say "no change" if that is the news. The cheat sheet notes that triage, development and deployment take time, particularly in an enterprise, so patience works both ways.
Close the loop
When a fix ships, tell the researcher, offer to let them retest, and say how you will credit them. If you publish an advisory, send them the draft first. Our guide to what to do when the first report arrives walks through the internal steps behind this reply.
If you disagree with the report
Explain your reasoning with specifics: what control prevents the attack, or why the affected data is public. Invite correction. Researchers sometimes know something you do not, and sometimes you know something they do not. Either way the exchange should be professional.
Quick check
How fast should the first acknowledgement go out?
The cheat sheet says promptly without giving a number. Pick a target you can meet every time, publish it in your policy, and track it.
Who should send the reply?
A named person on the security or engineering team. Avoid anonymous no-reply mail.
Sources
Last reviewed: 19 October 2026.
