Disclosure inbox

The Disclosure inbox collects every vulnerability report sent through your disclosure page or by email to your inbound address. Each report keeps the whole conversation with the reporter and an append-only triage log, so you can answer the reporter, decide what the report is and show later how you handled it.

​

Where reports come from

Web form. A report from /disclose/<your-slug> arrives with the product family the reporter chose, the language of the form and whether they want to be credited. Email. Every email to the inbound address under Settings → Disclosure becomes a report. Forward your security@ mailbox there. The email’s subject becomes the report’s subject, without Re: or Fwd: prefixes, and the sender’s name and address are the reporter. Pharus keeps the message as plain text and only the names of attachments: “Ask the reporter to share files another way if you need them.” Acknowledgement. When a report has an email address, Pharus emails the reporter straight away: “We received your report”, with the report number, your acknowledgement time, the policy and the privacy notice. It goes out in the language of the form they used; an email report gets your company’s Default language. Auto-replies, bounces and mailing-list mail get no acknowledgement. The triage log records “Acknowledgement sent”. Follow-ups. When the reporter writes again from the same address, with the report number in the subject (for example [#118]) or as a reply to one of your emails, the message joins the report and the log records “Reporter wrote again”. Mail from any other address opens a new report, even with a report number in the subject.

​

The inbox list

Open Disclosure inbox in the sidebar. The header links to your Public form and to Disclosure settings. The tabs filter by status: Open (New, Triaging and Accepted, the default), New, Triaging, Accepted, Resolved, Duplicate, Rejected and All. Each row shows the number, the subject and channel, the reporter, the product, the severity, when it was received, the first response and the status. A report without a name or address shows as “Anonymous reporter”. The First response column shows where each report stands: The deadline is the end of the last business day in your Acknowledge within setting, counted from the Oslo day the report arrived. Weekends and Norwegian public holidays don’t count. The automatic acknowledgement doesn’t stop the clock; your first reply does. For a report with no email address, the first status change does.

​

Read a report

Select a report to open it. The header shows when it was received (Oslo time), the reporter, the channel, the product family (“Not stated” if none), whether the reporter “Would like to be credited” and the first-response deadline. The Conversation card shows every message in the order sent and received: the reporter’s on the left, yours indented with the sender’s name, and the automatic acknowledgement as “Sent automatically”. An encrypted message carries an OpenPGP encrypted badge and is shown as it arrived; decrypt it with your own key, outside Pharus.

​

Reply to the reporter

The reply’s reply-to address is your inbound address, so when the reporter answers, their message comes back to this report. The email’s footer follows the language of the form the reporter used; the message is your own text, so write in the reporter’s language. If the reporter left no email address, the card says “The reporter left no email address, so you can’t reply from Pharus.”

​

Triage the report

The side panel on a report holds the triage controls. Every change goes into the triage log and the audit trail.

​

Status

Pick the new status, add an optional Note and select Update status. Duplicate and Rejected need a note: “Say why. The reporter may ask, and it goes in the triage log.”

​

Classification

Set Severity (Critical, High, Medium, Low or None; “Not rated” until you do) and the Product family, then select Save classification. The product family also decides which SBOMs the upstream report draws on.

​

Links

Under Links, connect the report to what it is about:

• Vulnerability ID: type an ID such as CVE-2026-41120 or a GHSA ID and select Link vulnerability. The report then links to the vulnerability’s page.
• Incident: choose an open incident and select Link incident. Drills aren’t offered.

​

Triage notes

Use Triage note and Add note for what you found, for example “Reproduced on Gateway G3 4.2. Not on 4.1.”

​

The triage log

The Triage log is append-only: “Entries can’t be changed afterwards.” It records, with who and when:

• Report received via web form or email, with the form language and the credit choice
• Acknowledgement sent, replies, and each time the reporter wrote again
• Status changes, with the note
• Severity and product family changes
• Links to a vulnerability or an incident
• Notes
• Removal of the reporter’s personal data

​

Declare an incident from a report

If the report shows that a vulnerability is being actively exploited, or describes a severe incident, the CRA reporting clocks apply (CRA Art. 14(1) and 14(3)). Declare the incident from the report, so the two stay linked. On Free you can’t declare an incident. The card says so instead: Pharus doesn’t run the CRA clocks or prepare SRP packs on Free, so if the report needs reporting, file it in ENISA’s Single Reporting Platform yourselves, or start a plan.

​

Report the flaw upstream

When the flaw is in a third-party component, the report page has a Report to the component’s maintainers card. Set the report’s product family first: the component comes from that family’s SBOMs. Pharus drafts the report in English; you send it. See report upstream.

​

Draft an advisory

A report has no advisory button. Draft the advisory under Advisories → Draft advisory, or from the incident’s Customer advisory card if you declared one. If the reporter asked to be credited, add their name under Acknowledgments in the advisory. See advisories.

​

Remove a reporter’s personal details

If a reporter asks you to delete their personal data, an owner or admin can remove it from the report. Pharus removes the reporter’s name, email address and IP hash from the report, its conversation, the triage log, the audit trail and the email log. The report then shows the reporter as “Removed on request”. What they wrote stays, and so do your own notes: check them for anything else that identifies the reporter. Removing a reporter’s details also works when the workspace is read-only, because the request can’t wait for a subscription.

​

Notifications for new reports

• Email. Owners and admins with alert emails on get “New vulnerability report” with the number, subject, reporter, channel, product and the date to acknowledge it by. Each person turns alert emails off under Settings → Notifications. Members don’t get these emails.
• Slack, Teams and webhooks. On Core and Plus, and during the trial, a destination subscribed to “New disclosure reports” gets the report number, the product family and the acknowledgement deadline, never the reporter or what they wrote. See notifications and outgoing webhooks.

​

On Free

If an owner closes the workspace, no new reports arrive and the inbox is read-only, except for removing a reporter’s details.

​

Related