Frontline staff are often the first people to receive a vulnerability report, because researchers write to whatever address they can find. Train support to recognise the signs, avoid replying with technical judgments, keep the report confidential, and hand it to the security owner within the hour.
Why this matters
The OWASP cheat sheet lists staff training as part of intake: frontline staff should recognise security reports and escalate them to the right people. A report that sits in a general queue for a week gives the researcher a reason to go public or stop trying.
Signs a ticket is a security report
Teach these patterns:
- The subject mentions a bug, flaw, exposure, leak or "security issue".
- The sender says they found something on your site or app without being a customer.
- The message includes URLs with unusual parameters, request dumps or screenshots of error pages.
- The sender mentions a deadline, a reward or a CVE.
- It reads like a sales pitch for a scanning service. Treat those separately, but still forward them.
What support should do
A one page runbook is enough:
- Do not delete, close or forward the message to a large group.
- Tag the ticket with a security label so it leaves the public queue.
- Message the security owner directly, with a backup name.
- Send the standard holding reply, which says the report has been passed to the security team.
- Make no promises about fixes or rewards.
What support should not do
Support should not try to reproduce the issue, rate its severity or tell the sender it is not a problem. They should not ask for proof beyond what was sent, and they should not mention that the company might take action against the sender. The first reply template gives them safe wording.
Make the path short
Publish one address for security reports, list it in your security.txt file, and keep it out of the general helpdesk flow. Fewer misrouted reports means less training burden.
Test the process
Once a quarter, send a harmless test message to your support inbox that looks like a report, and time how long it takes to reach the security owner. Fix whatever slowed it down. The first real report is a bad time to find a broken forwarding rule.
Quick check
Should support see the technical details?
Only as much as needed to route it. After escalation, restrict access to the security team and the engineers fixing the issue.
What if the report arrives through social media?
Reply publicly with the official security address only, and ask for the details to be sent there. Do not discuss the issue in public.
Sources
Last reviewed: 19 October 2026.
