> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pharussecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Disclosure page
> Set up your public disclosure page: the report form, hosted policy and privacy notice, security.txt and the address to forward security@ to.
**Plans:** Every plan, and Free. **Who:** anyone can open the public pages; owners and admins change **Settings → Disclosure**, and members can view it.
Every workspace has a public disclosure page where researchers, customers and anyone else can report a vulnerability in your products, without signing in. Pharus hosts the report form, your coordinated vulnerability disclosure policy, a privacy notice for reporters, a security.txt file and your published advisories. Every report lands in the [disclosure inbox](/disclosure/inbox).
The CRA asks manufacturers for a coordinated vulnerability disclosure policy and a contact address for reporting vulnerabilities (CRA Annex I, Part II, points (5) and (6)). The disclosure page gives you both.
## The public pages
All pages live under your company's slug and need no sign-in.
| Page | Address | What it shows |
| - | - | - |
| Report form | `https://app.pharussecurity.com/disclose/` | The form, links to your policy and advisories, and your contact email |
| Policy | `https://app.pharussecurity.com/disclose//policy` | Your coordinated disclosure policy and how to contact you |
| Privacy notice | `https://app.pharussecurity.com/disclose//privacy` | How you handle reporters' personal data |
| Security advisories | `https://app.pharussecurity.com/disclose//advisories` | Your published TLP:WHITE advisories. See [advisories](/disclosure/advisories) |
| security.txt | `https://app.pharussecurity.com/disclose//security.txt` | The generated RFC 9116 file. See [security.txt](/api-reference/security-txt) |
Your slug comes from your company name when the workspace is created. **Settings → Disclosure → Public pages** shows the exact addresses, each with a copy button and an **Open** link.
The pages are in Norwegian (bokmål) and English. A language switch in the header keeps the reader on the same page. Add `?lang=nb` or `?lang=en` to a link to choose the language; without it, the pages use the **Default language** from **Settings → Company**.
An address with an unknown slug shows a short "page wasn't found" message in both languages, which points the reader to the security.txt on the manufacturer's website.
## What researchers see
The report form page opens with "Report a vulnerability" and tells the reader you confirm every report within the number of business days you set. Below that are links to **Read the disclosure policy** and **Security advisories**, a link to your OpenPGP key if you set one ("Prefer to encrypt? Use our OpenPGP key"), and "You can also email" with your public contact email if you set one.
| Field | Required | Notes |
| - | - | - |
| **Your name** | No | |
| **Your email** | No | "Optional, but we need it to reply to you." Without an address you can't reply from Pharus. |
| **Product** | No | Your active product families, or **Not sure**. |
| **Subject** | Yes | 3 to 200 characters. |
| **Details** | Yes | At least 30 characters. The hint asks for the product and version, how to reproduce it and the impact, in Norwegian or English. |
| **May we credit you?** | No | "We name you in the security advisory when the issue is fixed." The choice shows on the report in the inbox. |
Under the form, the reader is told the report goes to your security team and that their contact details are used only to handle it, with a link to the privacy notice.
After **Send report**, the reader sees "Thank you. We received your report", their report number (for example `#118`) and what happens next:
* You confirm that you received it within your acknowledgement time.
* They get an initial assessment within 5 business days.
* You keep them updated until the vulnerability is fixed or declined, and agree a publication date with them.
If they left an email address, Pharus also sends them an acknowledgement email in the language of the form, with the report number, a link to your policy and a link to the privacy notice. They can reply to it to add details. If they left no address, the page tells them you can't reply, and that they can send another report with their address and the report number. **Send another report** starts a new report and keeps their name, email and credit choice.
The thank-you page and the acknowledgement email always promise an initial assessment within 5 business days, as the default policy does. Only the acknowledgement time is a setting.
### Protections on the form
* **Hidden field.** The form has a field people don't see. A submission that fills it in gets the usual thank-you page, without a report number, and nothing reaches your inbox.
* **Rate limit.** One network can send five reports an hour to your page. After that, the form asks the reporter to wait a while or email you instead.
* **No IP addresses stored.** For the rate limit, Pharus keeps a keyed hash of the reporter's IP address, never the address itself, and deletes it after one day.
* **Encrypted reports.** If a reporter pastes an OpenPGP-encrypted message, the report is marked **OpenPGP encrypted** in the inbox and shown as it arrived. Decrypt it with your own key, outside Pharus.
## Set up the disclosure page
The page works from the day the workspace is created, with the default policy and your company's security contact. Make it yours before you link to it.
Go to **Settings → Disclosure**. Only owners and admins can change it; members see it read-only.
Copy the address under **Inbound address** and forward `security@` (or whichever mailbox you publish) to it. See [Inbound address](#inbound-address).
Under **Contact and policy**, set the public contact email, the acknowledgement time and the other fields described below. Write your own policy and privacy notice, or keep the defaults.
Select **Save disclosure settings**. The public pages and security.txt change straight away.
Put security.txt on your own domain and link the form from your website and product documentation. See [Link to the page](#link-to-the-page-from-your-website-and-documentation).
### Inbound address
**Inbound address** shows an address of the form `r-…@…` under **Forward to**, unique to your workspace. Every email to it becomes a report in the disclosure inbox, and replies you send from Pharus come back to the same report.
Use a forwarding rule or an alias on your mail server, so messages arrive with the reporter as the sender. A message someone forwards by hand from their mail program arrives from that person, and Pharus treats them as the reporter.
If the address leaks or gets spam, select **Rotate address**. The current address stops working straight away, so update the forwarding rule on your security mailbox to the new one.
### Contact and policy
| Field | What it does |
| - | - |
| **Public contact email** | Shown on the form and the policy page, and the first `Contact` line in security.txt. Leave it empty to offer the web form only. It starts as the **Security contact email** from **Settings → Company**. |
| **Acknowledge within** | 1 to 30 business days; 2 by default. Published on the form, in the policy and in the acknowledgement email. The inbox counts Norwegian business days and shows the deadline on each report. |
| **OpenPGP key URL** | Optional, a full `https://` address. Adds the key link to the form and the policy page, a line to the default policy, and the `Encryption` field in security.txt. |
| **Canonical URL** | Where you publish security.txt, for example `https:///.well-known/security.txt`. Leave it empty to use the hosted file. Its host also becomes the publisher namespace in your [CSAF advisories](/api-reference/csaf-feed#publisher-namespace). |
| **Expires** | Leave it empty and the `Expires` field in security.txt rolls forward by itself, always 11 months ahead. Or pick a date in the future, less than a year ahead. |
| **Policy in Norwegian**, **Policy in English** | Your coordinated disclosure policy. Leave both empty to publish the default. |
| **Privacy notice in Norwegian**, **Privacy notice in English** | What reporters are told about their personal data. Leave both empty to publish the default. |
There are no other settings: no embargo period, no languages to choose and no key to upload. The default policy promises to agree a publication date with each reporter.
### The disclosure policy
The default policy is filled in from your settings and changes when they do. It has these sections:
* **Scope:** your active product families, with their firmware, apps and the cloud services they depend on.
* **How to report:** the form, your contact email if set, Norwegian or English, and your OpenPGP key if set.
* **What to expect:** confirmation within your acknowledgement time, an initial assessment within 5 business days, regular updates, coordinated publication with an advisory when a fix is available, credit if wanted, and a notification to the authorities if the vulnerability is actively exploited.
* **Safe harbour:** no legal action against good-faith research within the policy, and the rules for testing.
* **Out of scope:** scanner findings without impact, missing headers, denial of service, spam, social engineering and other vendors' services.
To write your own, select **Use the default policy** to copy the default into the box, then edit it. A line starting with `##` is a heading, a line starting with `-` is a list item, and a blank line separates paragraphs. Each text can be up to 20 000 characters.
Readers get your policy in their language if you wrote one, otherwise in English, otherwise in Norwegian, with a note such as "Nordlys Elektronikk AS has published this policy in English only." The default appears only when you have written neither. Your own words always win over a translated default.
### The privacy notice
The privacy notice at `/disclose//privacy` tells reporters how their personal data is handled (GDPR Art. 13). Your company is the controller; Pharus is your processor. It is linked from the form, under it, from the footer of every public page and from the acknowledgement email, so reporters who only used email see it too.
The default notice covers who is responsible, what is collected, the purpose and legal basis (GDPR Art. 6(1)(f) and 6(1)(c)), who sees the data, how long it is kept, the reporter's rights and how to complain to Datatilsynet. It names your public contact email for questions, or the form when you have none. **Use the default notice** copies it into the box for editing. The same language rule applies as for the policy.
### security.txt
The **security.txt** card shows the file generated from these settings, with **Publish it on your own domain** instructions next to it. The `CSAF` line appears once you publish a TLP:WHITE advisory. See [security.txt](/api-reference/security-txt) for the fields and how to serve it from your domain.
## Link to the page from your website and documentation
* **Your website.** Link the form, for example as "Report a vulnerability" in the footer or on your security page, and link the policy. Add `?lang=en` for your English pages.
* **security.txt.** Serve it at `https:///.well-known/security.txt`, by redirect or by copying the file. See [security.txt](/api-reference/security-txt).
* **Product documentation.** The CRA asks the information for users to include the single point of contact where vulnerabilities can be reported and where your coordinated disclosure policy can be found (CRA Annex II, point 2). Use the form and policy addresses.
* **Advisories.** Link `https://app.pharussecurity.com/disclose//advisories` where customers look for security updates.
```html theme={null}
Report a vulnerability
Coordinated disclosure policy
```
The public pages can't be embedded in a frame on another site. Link to them instead.
## On Free
Without a subscription, the disclosure page keeps working: the form, the policy, the privacy notice, security.txt, the advisories page and the inbound address. Owners and admins can still change **Settings → Disclosure**, and the team can answer reports in the [inbox](/disclosure/inbox).
If an owner closes the workspace, the form shows "Reports are no longer taken here" with your public contact email, if you set one. Email to the inbound address is no longer accepted, and security.txt returns `404`. Published advisories stay up until the workspace is deleted. See [data and deletion](/workspace/data-and-deletion).
## Related
Answer and triage the reports that come in.
The generated file and how to serve it from your domain.
Publish CSAF/VEX advisories on the same public site.
What keeps working on Free.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.