Vulnerability disclosure policy for open-source libraries under the CRA

Short answer: Manufacturers in scope must have and enforce a coordinated vulnerability disclosure policy and a contact address for reports. For an open-source library, publish it where researchers actually look: SECURITY.md, GitHub private vulnerability reporting, and security.txt on the project site.

What a CVD policy for an open-source library should cover

• Where and how to report (email/form/platform), languages, encryption.
• What you promise: acknowledgement time, status updates, target fix timelines.
• Safe-harbour wording for good-faith research.
• How you coordinate disclosure and credit reporters.
• Link to your support period and how fixes reach users.

Related: Is my open-source library in scope? · 24h reporting

Not legal advice. Templates + software. Verify against the CRA text (Regulation (EU) 2024/2847), Commission guidance C(2026)5252 or a qualified advisor.

Last reviewed: 2026-10-30