Skip to main content

The Submission Lifecycle

The submission lifecycle takes a vulnerability report from receipt to closure. The audit log records the actions on each report.

Report statuses​

Each report has one of five statuses: New, Acknowledged, In progress, Resolved and Dismissed. A member can acknowledge a report and set any status except Dismissed. Only an admin can dismiss or close a report.

Report handling stages​

The stage bar guides each report through seven stages.

  1. Receive. You acknowledge the report to start coordinated disclosure.
  2. Assess. You link the affected product and set the severity score.
  3. Decide Article 14. You record the exploitation status. You can click Record: not actively exploited when no exploitation occurs.
  4. Report to CSIRT. The platform drafts required regulatory notices when statutory reporting triggers apply.
  5. Fix. You assign an owner and verify the technical fix.
  6. Disclose. You publish a coordinated security advisory for users.
  7. Close. An administrator closes the report with a reason, as resolved or dismissed. An Article 14 stage that is still due stays due after the report closes.