[DL.SCM.7] Standardize vulnerability disclosure processes

Category: RECOMMENDED

A standard vulnerability disclosure policy helps ensure consistent reporting and handling of potential vulnerabilities, which in turn enhances the security of the software development lifecycle. Implementing standardized vulnerability disclosure practices is recommended for optimizing DevOps, as it promotes security, helps manage risk effectively, and encourages the responsible reporting and handling of discovered vulnerabilities.

A method for implementation is provided in RFC 9116, A File Format to Aid in Security Vulnerability Disclosure (Foudil, Shafranovich, & Nightwatch Cybersecurity, 2022). This guidance provides a standardized process for vulnerability disclosure using a machine readable security.txt file, which contains contact details and the vulnerability disclosure policy. This file is to be placed in the /.well-known/ path of  a domain name or IP address to enable security researchers to find the right information to report vulnerabilities they discover easily.

Related information: