security.txt + disclosure policy generator
The Cyber Resilience Act (Annex I Part II(5)–(6)) will require every manufacturer to publish a coordinated vulnerability disclosure policy and a security contact from 11 December 2027 (Art. 71(2)). Publishing now is cheap, and buyers already ask for it. Fill in three fields and publish the two files it produces.
Your details
Generated in your browser and on our server without storing anything. Publish security.txt at /.well-known/security.txt. Renew it before the Expires date.
security.txt
# fill in the form
Disclosure policy Markdown
# fill in the form
The policy is the easy part. The 24-hour clock is not.
Since 11 September 2026 an actively exploited vulnerability in your product must be reported to ENISA within 24 hours of awareness. ExploitClock watches your SBOMs against CISA KEV, ENISA EUVD, OSV and EPSS, starts the clock, drafts the notifications and keeps tamper-evident evidence.
Start free trial · 14 days, no card