Reporting a vulnerability to a vendor with no security contact

If a vendor has no security contact, try these in order: look for a security.txt file or disclosure page, write to published security or support addresses, reach a person through professional channels, then ask a coordinator such as CISA or CERT/CC to contact the vendor for you. Keep records of every attempt and date.

Step 1: look for a published channel

Check the vendor's website for a disclosure policy, a security page, or a file at the standard location. OWASP's cheat sheet tells organizations to publish a security.txt file with at least the Contact and Expires fields, so a well run vendor may have one. See how to write and publish security.txt.

Also check the product's repository, if it is open source. A security policy file or private reporting option is common there.

Step 2: write to what exists

If you find no policy, send a short message to a security address, a general contact or support. Keep technical details out of the first email if the channel is not secure. Ask for a secure way to send details. OWASP says frontline staff need to know how to escalate security reports, and a clear subject line helps them do it.

Step 3: try a person

A professional network contact in the vendor's engineering or security team can route a report faster than a generic inbox. Share only the minimum: that you have a security issue and need a private channel.

Step 4: use a coordinator

Coordinators exist for this case. The CERT Guide to Coordinated Vulnerability Disclosure describes coordinators as the party that manages sharing of vulnerability information between stakeholders, with the CERT Coordination Center as an example.

CISA's published process starts with a report submission through its VINCE-NT system. CISA's team then triages the report and, if it is in scope and meets criteria, identifies and contacts the supplier. It also determines whether a CVE ID applies. Out-of-scope reports may be referred or closed, so describe the impact and affected product clearly.

Step 5: understand the timeline

CISA's page says it may disclose vulnerabilities as early as 45 days after the first attempt to contact the vendor when a vendor is unresponsive or will not set a reasonable remediation timeframe, regardless of whether a patch exists. Other groups use different clocks. See disclosure deadlines compared.

Keep a record

Write down each attempt: date, channel, address, who replied. If you later involve a coordinator, that record shows good faith and helps them follow up. Follow the checklist in what to put in a vulnerability report.

If you are the vendor

The fix for this problem is on your side. Publish a contact, route it to someone, and acknowledge reports promptly. See how to write a vulnerability disclosure policy.

Safeguard can show a team which of its own dependencies carry a known vulnerability, so that upstream reports are filed with accurate version information.

Quick check

Sources

• OWASP Vulnerability Disclosure Cheat Sheet
• CISA Coordinated Vulnerability Disclosure process
• CERT Guide to Coordinated Vulnerability Disclosure

Last reviewed: 19 October 2026.