Keep working. A silent reporter does not pause your remediation. Send a clear follow-up, set a date, document your attempts, and carry on through fix, release and advisory on your own timeline. The CERT Guide to Coordinated Vulnerability Disclosure says the vendor is not obligated to keep chasing the reporter.
What the guidance says
In its troubleshooting scenarios, the CERT Guide to CVD states that when a reporter stops responding, the vendor is not obligated to keep chasing them. The vendor should continue through the remaining phases and apply any bounty policy. That is a sensible default for a small team, because your customers' exposure does not depend on whether the reporter answers email.
Steps
- Check your own side first. Did your last message ask a question? Did it land in spam? Resend from a different address if you can.
- Send one clear follow-up. State the question, what you will do if you hear nothing, and the date.
- Try one other channel the reporter gave you, such as the platform they used or a handle on their profile. Keep it professional and brief.
- Record each attempt with date and channel in your tracker.
- Continue the work. If you have validated the issue, fix it. If you could not validate it because you need more detail, set a closing date and say so.
- Credit them anyway, according to your policy, using the name or handle they first gave you. If you have no preference on record, ask once more or credit as the policy describes.
- Tell them when you publish. A last message with the advisory link is courteous and sometimes brings them back.
Two situations that look the same but are not
| Situation | What to do |
|---|---|
| Silent after you asked for more detail, and you cannot reproduce | Set a closing date, close as cannot reproduce, invite them to reopen |
| Silent after you confirmed and fixed the issue | Release and publish on your schedule, credit them |
Wording for the closing message
We could not reproduce this on version 4.2 with default settings, and we have not heard back since the 3rd. We are closing the case on the 20th. If you can send the missing details before then, or after, we will reopen it.
Plain, dated and without blame.
What to avoid
- Waiting indefinitely before shipping a fix you already trust.
- Threatening the reporter, or hinting at consequences, because they went quiet.
- Dropping the credit because they stopped replying.
- Closing an unvalidated report with no message at all.
Try it yourself
The continuous monitoring demo shows how open items stay visible until someone resolves them, which is the habit your report tracker needs for cases that stall. Look at how nothing disappears until it has an outcome.
Click through it at your own pace, or open it full screen.
Quick check
How many follow-ups should we send?
Policies differ. Two or three dated messages over a couple of weeks, on more than one channel if you have it, is a reasonable record. Write your number into your policy so it is not a case by case argument.
Do we still need an advisory if the reporter vanished?
If customers need to act, yes. The advisory is for them, not for the reporter.
Safeguard's compliance and evidence automation can keep a record of what was done and when, which helps when you need to show your process later. The free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
