A security report from someone you do not know can be valuable, incomplete, or mistaken. It still needs a clear place to arrive and a proportionate review. A small, predictable process helps you understand the claim while protecting information and keeping changes under control.
Understand the idea
Ask for the affected service, a clear description, the observed result, and enough safe evidence to understand the issue. Confirm ownership before testing. Avoid asking the reporter to collect more sensitive data than necessary, and agree how further communication will happen. Acknowledge the report without promising an outcome before assessment.
- Receive
Acknowledge the report through an appropriate channel.
- Triage
Verify the claimed issue within your own approved scope.
- Coordinate
Agree handling, ownership, and communication.
A practical example
Imagine a researcher reporting that a document link exposes private files. The site owner acknowledges the message, checks the claim with controlled accounts, and restricts the unintended sharing route. The owner then tells the reporter what has been confirmed and how the correction will be checked.
What to do next
- Confirm that the asset belongs to the organization and identify its owner.
- Assess urgency from the claimed impact and exposure, distinguishing an unsupported assertion from verified evidence.
- Reproduce only within authorized scope and a suitable environment, with a qualified reviewer where needed.
- Preserve relevant logs and apply proportionate containment for a credible live exposure.
- Record the correction, retest, communication, and any remaining uncertainty.
How to check the result
Keep the report, assessment, owner, and retest together. Publish a working contact route and review whether an ordinary reporter can find it without guessing a staff member’s private address.
The reporter wants us to prove cross-customer access by sending records.
Do not disclose more customer information to validate a claim. Ask for minimal evidence and investigate through your own controlled process.
Sources and useful guides
The following resources provide background and more detailed guidance. Use the sections that match your service and situation.
