Handling Encrypted Reports

Protecting the confidentiality of zero-day vulnerabilities and sensitive system architectures is a paramount concern under the Cyber Resilience Act (CRA). The CVD Portal publishes your PGP public key so that researchers can encrypt report details before they send them.

The portal supports PGP (Pretty Good Privacy) for encrypted researcher communications. You can upload and publish your organization's PGP public key via Settings → PGP / Security, making it easily accessible to researchers - including through your automated security.txt file and public disclosure policy page.

The submission form has no separate field for encrypted content. A researcher can paste PGP-encrypted text into the report fields. The portal stores that text and shows it as it is in the submission detail view. The form also has an optional field for the researcher's own PGP public key. The submission detail view shows that key as Researcher PGP Key. Decryption is performed locally by your team using your private key - private keys are never uploaded to or stored by the platform. This model follows security best practice: the server holds only your public key, and your private key stays in your control at all times.

By supporting PGP-encrypted submissions, your organization signals a strong commitment to operational security and builds trust with researchers who require confidentiality when disclosing high-impact vulnerabilities.