Lion Cipher Lab
Publish a vulnerability disclosure policy and a valid security.txt, then measure your intake
- GRC / Compliance
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Somewhere right now a stranger has found a bug in a small company's website and is trying to decide what to do with it. If there is no obvious place to report it and no promise that they will not be sued for having looked, the most likely outcome is that they give up -- or post it publicly. CISA said exactly this when it ordered every US federal agency to publish a vulnerability disclosure policy (Binding Operational Directive 20-01): reporters often cannot work out where to send a report, and many fear legal action. The fix is cheap: a short policy page that says what is in scope, that…
What you'll learn
- explaining what a vulnerability disclosure policy (VDP) is, what it legally and practically promises, and the six things a reporter needs from it (scope, authorization, allowed test methods, how to report, an acknowledgement timeline, anonymous reporting) as set out in CISA BOD 20-01 and the CISA VDP template
- writing an RFC 9116 security.txt -- Contact, Expires, Policy, Preferred-Languages, Canonical -- and knowing which rules are MUST (Contact present, exactly one Expires, https:// for web URIs, served over https at /.well-known/security.txt as text/plain; charset=utf-8) and which are advice (Expires less than a year out)
- building a standard-library Python validator for security.txt and measuring a real before/after: a naive 'file exists' check passes all 4 broken files, the validator finds 13 errors across them, and the fixed file scores 0 errors and 0 warnings
- serving the policy and security.txt locally with python -m http.server to prove the /.well-known path works, and reading why the same valid file still fails 3 DEPLOYMENT checks (http, missing charset, Canonical mismatch) until it is on the real https host
- replaying a 30-report intake log against the VDP's own promises and measuring it: valid reports triaged within 7 days went from 3/12 to 12/12 (median 401.5 h -> 4.7 h) after adding a triage rota and auto-acknowledge
- naming the honest negatives: the acknowledgement metric was already 26/26 before the change, 18 of 30 triage slots still go to duplicates, out-of-scope and junk, a 40-report scanner flood pushes valid-on-time back to 10/12, a keyword check scores a hostile policy 6/6, and security.txt cannot make anyone use it
Steps in this lab
- The problem: a stranger found your bug and has nowhere to send it
- How this lab differs from its neighbours
- Set up: open a terminal, check Python, make a folder
- Write the VDP: six things a reporter needs from you
- Measure the VDP -- and see why a keyword check is not a review
- Write security.txt -- and four broken ones to test against
- Build the validator
- Measure: 'it exists' says 4/4 pass; RFC 9116 says 13 errors
- Serve it locally at /.well-known -- and read the 3 deployment errors
- Part 2: a month of incoming reports
- Measure the intake: before, after, and a flood
- Judgment: what these files can and cannot do
- What you built -- and the reflex to keep