Let People Tell You.

Every system that faces the public gets looked at by the public. Most of the people looking are harmless, a few are not, and some of them notice something wrong and want to say so. Outsiders will find your vulnerabilities. What you control is whether the first ones to find them have a safe, obvious way to tell you.

In October 2021, a reporter at the St. Louis Post-Dispatch found that a Missouri education department website exposed the Social Security numbers of teachers, administrators and counselors in the HTML of a publicly accessible page. He told the state and held the story until the numbers were no longer exposed. Governor Mike Parson's response was to call him a hacker and push for criminal prosecution. In February 2022 the county prosecutor declined to charge him, saying his investigation "didn't uncover what we believe to be any criminal intent." The reporter had done what anyone would want a finder to do. It still cost him months under a cloud.

Germany had its own version the same year. In May 2021 the security researcher Lilith Wittmann found that the CDU's canvassing app, CDU Connect, exposed personal data of 18,500 campaign helpers and 1,350 supporters, and reported it to the party so it could be fixed before going public. The party filed a criminal complaint, and Berlin's cybercrime police opened an investigation against her. Under public pressure the CDU withdrew the complaint and apologized, calling her inclusion a mistake. The Chaos Computer Club announced it would stop reporting vulnerabilities to the party at all. That's the real cost of threatening a reporter: the next one stays quiet.

The fix for this is old, boring, and well documented. It's called a vulnerability disclosure policy, and governments have been writing them for more than a decade.

The Netherlands got there early. At the end of 2012 the Dutch justice minister sent parliament a framework for responsible disclosure, with a note that the NCSC would publish the accompanying guideline and actively promote its use. In 2018 the NCSC replaced it with a coordinated vulnerability disclosure guideline, described as a revision of the 2013 Responsible Disclosure guideline. The renaming mattered: "coordinated" puts the burden on both sides, not just on the person who found the bug.

The United States made it mandatory for federal agencies. CISA's Binding Operational Directive 20-01, issued in September 2020, required every agency to publish a policy at a fixed path on its website, authorize the general public to test in-scope systems, allow anonymous reports, and commit not to recommend or pursue legal action against good-faith research. Within two years, every internet-facing federal system had to be in scope.

The EU wrote the coordinator role into law. Article 12 of the NIS2 Directive (EU) 2022/2555 requires each member state to designate a CSIRT as coordinator, acting as a trusted intermediary between the person reporting and the organization that owns the system, and to let people report anonymously if they ask. The same article told ENISA to build a European vulnerability database, which the Commission announced as launched in May 2025.

What the law still doesn't do everywhere is protect the reporter. In Germany, the justice ministry's 2024 draft would have made probing a system not "unauthorized" when done to find a flaw and report it to the operator, the vendor or the BSI, while leaving the so-called hacker paragraph, §202c, untouched. That government never got past the draft. As of late August 2026, the current coalition's promise of legal certainty for security research was still a vague declaration of intent, and the reform was still waiting, while the Gesellschaft für Informatik published a whitepaper calling for it. Until that changes, a German researcher's safety depends largely on whether the organization they report to has promised, in writing, not to come after them.

That promise is the core of a disclosure policy, and it's the part a small organization can write today without waiting for any legislature.

A minimal policy fits on one page. It says which systems and code are in scope, and that anything else should be checked with you first. It says what testers may and may not do: no denial of service, no social engineering, no pulling more data than needed to show the problem, and stop and tell you if you hit personal data. It gives one reporting channel that someone actually reads, and accepts anonymous reports. It tells reporters when to expect a reply; CISA's own template commits to acknowledging receipt within three business days. It asks for a reasonable window to fix things before publication, without forbidding publication. And it states plainly that good-faith research under the policy is authorized and that you won't pursue or recommend legal action over it. Then you make it findable: a security.txt file at /.well-known/ as defined in RFC 9116, which needs only a contact and an expiry date and can point to the policy. RFC 9116 itself points readers to ISO/IEC 29147:2018 for the fuller process.

This is where open code changes the math. A closed system can only be examined from the outside, by people poking at it, which is exactly the activity that gets reporters threatened. An open codebase can be read. Many bugs can be found by reading the source, at a desk, without touching a production server. Pair that with a published policy and you've turned a crowd of strangers into an unpaid review team that knows how to reach you and knows it's welcome. For open-source projects the tooling is already free: GitHub's private vulnerability reporting gives finders a private channel inside the repository, and the OpenSSF maintains a guide with SECURITY.md and disclosure templates for maintainers who have never run a disclosure before.

That matters most for the organizations that can least afford a security team: a municipal data office, a two-person civic-tech group, a volunteer-run portal running the same open-source stack as a national agency. They will never out-audit their own systems. They can make it easy and safe for someone else to tell them what's wrong.