Keep your reply short, polite and tied to your published policy. If someone demands money for details, the OpenSSF guide says unsolicited reporters should never ask you for money outside an official bounty program, so treat it as a red flag. Keep records, avoid arguing, and ask for the technical details you need.
Two situations that feel the same
Maintainers describe two kinds of pressure, and they deserve different handling.
A demand for payment. The reporter will share details only if paid. The OpenSSF guide advises watching for requests for payment in exchange for details, and says unsolicited reporters should never ask you for money unless an official bounty program exists.
A short deadline. The reporter says they will publish in a few days. That is common and not hostile in itself. Deadlines are a norm in coordinated disclosure, and the guide treats the embargo period as a starting point to negotiate, not a fixed rule. It cites common norms such as under 7 days, 45 days and 90 days.
How to respond to a payment demand
- Stay calm and write little. Thank them and restate your process: a private report, a fix, credit, an advisory.
- Do not pay under pressure. Payment for silence is a bad precedent, and you cannot verify what you are buying.
- Ask for the technical details anyway. Your policy does not depend on payment.
- Keep the thread. Save all messages with dates.
- Do not threaten back. Escalation helps nobody.
If you are unsure whether the claim is real, work out whether you can find the issue yourself, using the triage questions.
How to respond to a short deadline
- Acknowledge and ask for time. Explain that you are a volunteer, state your plan and propose a date. See the reply template.
- Offer progress updates on a schedule.
- Ask what they need. Some want credit, some want a fix before a conference talk.
- If the deadline holds, work toward a partial fix that breaks the exploitation chain, or prepare a workaround and notice. The guide describes both for stalled patches.
For how deadlines normally work, see disclosure deadlines explained.
Prepare before it happens
- State your process and expected timing in SECURITY.md.
- Have a second person who can read the thread. Two heads are calmer.
- Know who to ask for advice. Your host platform's support, a peer maintainer or a coordination body can help.
When to get outside help
If you receive threats beyond a disclosure deadline, such as harassment or extortion, stop engaging, save the evidence and seek advice from your platform or local authorities. This post gives no legal advice. If the project belongs to a company, tell its legal contact.
Quick check
Should I pay for details?
The OpenSSF guide says unsolicited reporters should never ask for money outside an official bounty program. Do not pay under pressure.
Is a short deadline always a threat?
No. It is a common opening position. Negotiate a date you can meet.
Sources
Last reviewed: 19 October 2026.
