When a vendor does not answer, follow up politely on a schedule you stated in your first message, try a second channel, bring in a coordinator, and give a final notice before you publish. Keep records. Do not go public early out of frustration.
Step 0: set expectations in message one
OWASP advises stating any planned publication period clearly and in a non-threatening tone. If you did that, every later step is just following your own words. If you did not, send a short note now with your timeline.
Step 1: a simple follow-up
After a reasonable wait, reply on the same thread. Keep it short: the date of your first report, a one line description, and a question about status. Assume the message was lost or misrouted. Support inboxes often are, which is why training support to route reports matters.
Step 2: another channel
Look for a different route: the security.txt file, a disclosure directory entry, a named security engineer. OWASP advises asking for the right staff member and avoiding social media for details. See finding a security contact.
Step 3: a coordinator
OWASP suggests a national or sector CERT when you cannot reach the organization. CISA runs an intake, triage and vendor contact process, and says it may disclose as early as 45 days after first contacting an unresponsive vendor. Read what CISA coordination offers first and check whether your issue is in scope.
Step 4: final notice and publication
Send one last message that states the date you plan to publish and what you will include. Offer to delay if the vendor engages. Publication is a last resort. Consider publishing a limited description with enough detail for users to mitigate, without a ready exploit.
Some policies use fixed windows, for example Project Zero's 90 days plus a 30 day post-patch window. Yours should reflect your own situation. See disclosure deadlines.
Keep a log
Record each date, channel and response. If anyone later questions your conduct, the log shows reasonable effort and good faith.
Quick check
Is silence consent to publish?
Not automatically. Follow the timeline you stated, show reasonable attempts, and consider the risk to users before you decide.
Should I tell the press?
Only as a late step, if at all. Details sent to journalists are effectively public.
Sources
- OWASP: Vulnerability Disclosure Cheat Sheet
- CISA: Coordinated Vulnerability Disclosure process
- Project Zero: Vulnerability Disclosure Policy
Last reviewed: 19 October 2026.
