Handling a report needs four roles, even in a team of five: a triage owner, an engineering fixer, a communications lead and someone who can make decisions. Name each in advance, write the handoffs down, and practice once. Confusion about ownership is what delays most fixes.
The four roles
Triage owner. Reads the report, reproduces it, rates it and answers the researcher. Keeps the case file.
Fixer. The engineer who knows the affected code. Builds and tests the fix, and proposes a mitigation if a fix needs time.
Communications lead. Writes the advisory and customer notices, and checks wording with legal if needed.
Decision maker. Approves timelines, disclosure dates, emergency releases, and any payment or credit. Usually a security lead or engineering director.
In a small team one person holds several roles. That is fine, as long as the roles are named.
The flow
- Acknowledge the report promptly, using a standard reply. See the first reply template.
- Reproduce in a safe environment.
- Confirm or decline, with reasons.
- Agree a fix timeline with the decision maker and tell the researcher.
- Fix, test, and review.
- Release, and notify the researcher.
- Publish an advisory if customers need to act.
- Retest with the researcher if they agree, and close the case.
OWASP's response guidance follows the same shape: acknowledge, clarify, confirm, set a fix timeline, communicate openly, let the researcher retest and confirm resolution.
The case file
Keep one record per report: the original message, dates and channels, reproduction notes, severity reasoning, owner, fix reference, advisory link and researcher credit. This is what you will want when a customer or auditor asks how you handle reports.
Practice
Run a table top once a year using a fictional report. Time how long each handoff takes and update the runbook. What to do when the first report arrives gives a starting scenario.
Common failures
- No backup for the triage owner on leave.
- Fixers learning about the report from a customer.
- The researcher hearing nothing for weeks.
- An advisory drafted after the fix is already live, with no review.
Quick check
Who should own the case file?
The triage owner, with the decision maker able to read it. Keep access limited to those who need it.
Should legal be involved from the start?
Involve them in policy and safe harbor wording ahead of time, and for specific reports when there is a legal question. They do not need to read every message.
Sources
Last reviewed: 19 October 2026.
