VULNERABILITY DISCLOSURE POLICY — WORKING OUTLINE
Dotgrey Continent resource. Adapt every bracketed field before publication.

Product scope: [products and supported versions].
Security contact: [monitored security email or reporting URL].
Encrypted reports: [public key URL, fingerprint and expiry, if supported].

Include the product/version, reproduction steps, impact, affected configuration,
and a safe proof of concept. Do not include personal data or secrets unnecessarily.

We aim to acknowledge within [realistic staffed period]. We will communicate
through [channel] and provide updates on [cadence]. These commitments must match
our team's capacity. Our escalation contact is [role/contact].

Please minimise testing impact. Do not disrupt services, access others' data,
retain unnecessary data, or test third-party systems without authorisation.
For questions about authorised testing boundaries, contact us before proceeding.

Our process: log and acknowledge; assess affected versions and impact; assign an
owner; coordinate remediation; validate the fix; agree disclosure communication.
Regulatory reporting is handled separately by our appointed reporting owner.

Coordinated publication: [contact/process for agreeing timing]. No payment or
bounty is offered unless a separately published programme explicitly provides it.

Policy owner: [role]. Last reviewed: [date]. Next review: [date].
Have security and legal owners review scope and testing terms before publication.