Separate two questions: is the vulnerability real, and did the reporter break your rules? Keep fixing the first no matter how you answer the second. Respond to a policy breach in proportion, usually with a reminder, and take concerns about harm or abuse seriously. Seek advice from a qualified lawyer where needed.
What the guidance says
The CERT Guide to Coordinated Vulnerability Disclosure, in its vendor scenarios, covers a finder who appears to have broken the rules during discovery. It says to separate the vulnerability question from the policy question, keep remediating the vulnerability, handle misconduct proportionately, with a reminder rather than punishment, and not tolerate abuse.
Examples of rule breaking
- Testing a system your policy excludes.
- Accessing more data than needed to prove the point.
- Running automated scans at a volume that affected service.
- Keeping data after proof.
- Contacting your staff or customers directly.
Each has a different weight. Reading one record to prove access is not the same as downloading a database.
Steps
- Pause and gather facts. What did they do, from your logs and from their report? Write it down neutrally.
- Keep the vulnerability case moving. Validate and fix as normal.
- Check the policy text. Did it clearly say what was off limits? Vague rules are hard to hold anyone to.
- Ask the reporter. A calm message asking what they accessed and what they kept often resolves it.
- Decide a proportionate response. For a minor overreach, a reminder and a request to delete any data. For serious harm, involve your leadership and a lawyer.
- Record the decision and the reasons.
- Update the policy so the boundary is clear next time.
Proportion table
| Behaviour | Suggested response |
|---|---|
| Tested an excluded host once | Reminder of scope, proceed |
| Viewed a few records as proof | Ask to delete, thank, proceed |
| Retained large amounts of data | Escalate, request deletion, seek advice |
| Threats or demands | Stop and escalate; see the post on reporters who ask for payment or threaten disclosure |
Why not punish
Reporters watch how vendors treat each other's reports. A heavy hand over a small mistake discourages the next person from telling you anything, and the flaw they found stays. A calm reminder protects both your users and your reputation. Abuse is different, and you do not have to accept it.
What not to do
- Treat the report as invalid because of how it was found.
- Reply with legal threats as a first move.
- Ignore the vulnerability while you argue about conduct.
- Change the rules after the fact and apply them backwards.
Quick check
Can a safe harbor statement help here?
It helps reporters know what is allowed. Wording matters, so have it reviewed by a lawyer. This post is not legal advice. See what safe harbor means in a disclosure policy.
Should we still credit the reporter?
Follow your policy. If the conduct was a minor overreach, credit is usually still appropriate. For serious breaches, decide with your leadership.
Safeguard's compliance and evidence automation can help keep a clear record of decisions and timelines. The free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
