A responsible disclosure form: what the issue is, how to reproduce it, what an attacker could do and whether it has been shared. The impact is required for critical and high issues. On Pro, critical reports, or ones the AI reads as exposing other people's data, end on an urgent acknowledgement, and an acknowledgement from your disclosure policy is written and ready, checked by a person before every send.
Software companies that want a proper place for security reports instead of a shared inbox, linked from security.txt or the footer.
Every question in this template
The pages as a respondent meets them. Pick any question to open it in the live preview above.
- Page 1Questions3 questions
- Page 2The issue7 questions
- Page 3Disclosure3 questions
- ThenThank you, the security team has it
We acknowledge every report within two working days and keep you updated until it is fixed.
Conditional logic is already set up
Every answer, in one place
Each response lands in your inbox as a card like this one, with an email to you if you want it. People who stop part-way are kept too, with the answers they gave.
- Partial answers and drop-off by question, on every plan
- CSV, JSON and PDF on every plan, Excel on Pro
- Sheets, Slack, Notion, Airtable, HubSpot and webhooks on Pro
Maya OkaforSecurity vulnerability report · just nowNew- Your name or handle
- Their answer, in their own words
- Your email
- maya@northstar.co
- Would you like to be credited when we publish a fix?
- Yes
- Summary of the issue
- Their answer, in their own words
- What kind of issue is it?
- Cross-site scripting
- Affected URL or endpoint
- northstar.co
and 7 more answers
Three steps, a couple of minutes
- Use this template1Make it your own copyIt becomes a draft in your account. Nothing you change touches the original.
- Reword, reorder, re-theme2Change anythingQuestions, pages, logic, theme and logo. It is an ordinary form from here on.
- formkit.app/you/security-vulnerability-report3Publish and shareYour own link, a QR code or an embed. Every answer lands in one inbox.
What this form can also do
Questions about this template
Who can see the reports?
Only the people you give access to the form. Keep it to the security team, and turn on two-factor sign-in for them.
Can it be password-protected?
Yes, but most disclosure forms are left open so anyone can report. Proof-of-concept files are kept with the response, not shared.
Will the AI reply say anything about the fix?
It is told not to. It thanks the reporter and explains your policy, and on this template every reply waits for a person to approve it.