Give the security address to a small team, not to one person and not to a big alias. Name one owner each week, one backup, and a written rule for who replies. The goal is that every report gets a human answer from someone who knows it is their job.
What CISA's guidance says
CISA's FAQ for the federal disclosure directive covers this exact question for agency mailboxes. It suggests a team email address created for these reports instead of an individual's address. The contact need not have 24/7 support, but someone should be responsive within a few business days, and the people tapped to respond should know they carry that responsibility.
It also compares a distribution list with a shared mailbox. A list spreads a message across a team without managing access to a separate inbox. A shared mailbox is a dedicated inbox several people can read. Either needs shared procedures so that staff do not reply from personal accounts.
The guidance warns that reusing an existing mailbox saves setup effort but can bury reports in noise and dilute a sense of responsibility, especially when membership is large. It also says to consider the value of a reply from a named human, not an auto-reply and not signed "the team."
A rota that works for five to fifty people
| Role | Responsibility |
|---|---|
| Weekly owner | Reads the inbox daily, sends first replies, opens cases |
| Backup | Covers leave and sick days, takes over after two missed days |
| Escalation contact | An engineering lead who can pull in developers |
| Case reviewer | Checks open cases weekly for stalled updates |
Rotate weekly so the load is shared and nobody burns out. Write the rota where everyone can see it.
Setup checklist
- Create a clearly named address such as security at your domain.
- Publish it in your disclosure policy and in a security.txt file.
- Route it to the owner and backup, not to the whole company.
- Add an auto-acknowledgment only if a human reply follows quickly.
- Add a rule that customer support forwards security reports within the same day.
- Keep reports out of general chat channels.
Handling reports that arrive elsewhere
Reports often land in support tickets, sales mailboxes or social media. OWASP's guidance says frontline staff who monitor contact addresses, web chat and phone lines should know how to handle security reports and who to escalate them to. A one page cheat sheet for support staff is cheap and effective.
Access and privacy
Reports can contain sensitive proof of concept details and sometimes personal data. Limit access to the people on the rota, and do not copy report contents into open tickets. If you offer encrypted email, note that CISA's guidance strongly recommends using the web instead where possible, because key handling is hard to run well.
Measure it
Count the time between receipt and first human reply. If the median creeps beyond a few business days, the rota is failing and needs another person or a clearer rule.
Quick check
Can the founder just read the inbox?
At a very small vendor, yes, but name a backup. A single owner means every vacation becomes an unanswered report.
Is an auto-reply enough?
It confirms receipt, but CISA's guidance values a reply from a named human. Send a short personal message too.
Sources
Last reviewed: 19 October 2026.
