Complass
PSIRT intake: accepting vulnerability reports under the CRA
On Friday evening a security researcher reports a vulnerability. On Tuesday it is actively exploited. From then on, 24 hours count.
The Cyber Resilience Act requires manufacturers to provide a single point of contact for vulnerability reports, a coordinated vulnerability disclosure policy and handling without delay. Since 11 September 2026 the reporting obligation for actively exploited vulnerabilities under Art. 14 also applies, including to products already on the market.
The whitepaper explains being reachable with security.txt and a disclosure policy, the process from receipt to assessment, the three reporting stages after 24 hours, 72 hours and 14 days, vulnerabilities in third-party components, informing users and the confidential handling of reports, with an 8-step plan and a practice example.
Each chapter includes a short "Implementation in Complass" box on the vulnerability reports area; only published features are named.
10 pages · Version 1.0 · as of 18.10.2026 · Author Marc Linden, Complass GmbH i. G.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.