Assign four roles: an intake owner who replies and logs, a validator who reproduces and scores, a fixer who writes and tests the patch, and a communicator who writes the advisory and handles the reporter. One person can hold two roles, but name a backup for each, and never leave a role unassigned.
Why roles help a small team
In a team of five, "everyone" is responsible, which means nobody is. Reports arrive on a Friday, one person is travelling, another assumes someone replied. Roles do not need a security department. They need names.
The CERT Guide to CVD describes roles in a coordination sense: finders, vendors, coordinators. Inside the vendor, you also need internal roles so that the vendor side can function.
The four roles
| Role | Does | Output |
|---|---|---|
| Intake owner | Watches the channel, acknowledges, logs, asks for missing detail | A tracked case with an owner and next date |
| Validator | Reproduces, finds scope, scores severity | A written outcome and a score with vector |
| Fixer | Writes, tests and reviews the patch | A merged fix and regression test |
| Communicator | Drafts the advisory, replies to the reporter, tells customers | Advisory, credits, release notes |
Handoffs
Handoffs are where cases die. Use one rule: the case always has exactly one named owner, and the owner changes only by an explicit message in the tracker. "I'm passing this to Sam" with a date.
Backups
Each role needs a backup. Plan for holidays and illness. A shared calendar with a rota, covering one week at a time, is enough. See who reads the advisory feeds, setting up an intake rota for a similar approach.
Who should not be the validator and the fixer
If you can, have different people validate and fix. The person who writes a fix is the least likely to spot where it is incomplete. In a very small team, ask the validator to retest the final patch, or invite the reporter to.
Where leadership comes in
Name one person who can make a call on delaying a release or pausing a feature. A security fix sometimes needs a decision above the engineers. If that person is the founder, say so, and agree what they need to be told and when.
Write it down
A half page in your repository's docs: names, backups, channels, who can approve an emergency release, and where the tracker lives. Review it each quarter, and when someone joins or leaves.
Try it yourself
The vulnerability management demo shows items with owners and states. Click through and see how every item has someone responsible, which is the pattern to copy for your cases.
Click through it at your own pace, or open it full screen.
Quick check
What if we have two engineers?
Split intake and communication on one side, validation and fixing on the other, and agree who covers when one is away.
Does an outsourced developer count as a backup?
Only if they can access the private channel, know the process and respond in your target time. Test it.
Safeguard's agent identity and policies can help control which tools and people get access to sensitive repositories. The free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
