A researcher emails the city's responsible-disclosure inbox with a clear XSS proof against the citizen portal instead of posting the bug publicly. How should the municipality treat this channel within vulnerability management?
Select an answer to reveal the explanation.
Short Explanation
A good disclosure program is like a tip line for city hall—researchers who play by the rules hand you XSS details so you can fix them before the evening news. Treat that inbox as a real vuln-identification path, not spam to ignore or a reason to go nuclear.
Full Explanation
Responsible disclosure and bug-bounty programs are ethical, external identification sources within municipal vulnerability management. When a researcher emails a clear XSS proof against the citizen portal through the published channel instead of dumping it publicly, the city should accept, triage, reproduce, and remediate under the program’s rules—exactly as it would treat a high-quality internal finding. That inbox converts good-faith research into actionable remediation before evening-news exposure or opportunistic exploitation.
Ignoring external reports because “only internal scanners are authoritative” discards a valuable identification path and can turn cooperative researchers into public disclosers. Immediately publishing exploit details on social media for “transparency” amplifies attacker advantage before a fix exists. Automatically suing researchers who followed the disclosure policy chills reporting, damages trust, and conflicts with the purpose of a responsible-disclosure program.
Exam caveat: triage still requires validation—not every submission is a true positive—and legal safe-harbor language must be clear. Bug bounties are identification inputs; they do not replace scanning, patching, or secure development. Scope and out-of-scope systems must be explicit for civic apps that handle PII.
Operational check: acknowledge receipt within the SLA, reproduce in a non-production twin, open a tracked vuln ticket with severity and owner, patch or mitigate, and only then coordinate any public credit so the citizen portal is fixed before details spread.