The EU put a 24-hour clock on your side project's vulnerabilities

Description and use

Developers shipping software into the EU must report active exploitation within 24 hours. The workflow includes a single intake channel, triage checklist, pre‑written drafts, ENISA readiness, and evidence logging.

Problem

Solo developers shipping software into the EU must report actively exploited vulnerabilities or severe incidents within strict timeframes under the EU Cyber Resilience Act, but many lack understanding and processes.

Outcome

Implementing the outlined workflow enables solo developers to meet CRA reporting deadlines, avoid credibility loss with CSIRTs, and maintain user trust.

Workflow

• Create a dedicated security@ email address and add a SECURITY.md to every repo.
• Develop a 15‑minute triage checklist to determine product scope, evidence of active exploitation, and user impact.
• Draft early warning, 72‑hour notification, and user notice templates in advance.
• Set up EU Login accounts for yourself and a backup person; determine CSIRT routing via the decision tree if no EU establishment.
• Maintain a dated evidence log with product inventory, role per product, intake records, and filing timestamps.

Evidence

If you ship software into the EU, you are now a "manufacturer" with a legal clock: an early warning within 24 hours of becoming aware of an actively exploited vulnerability or severe incident, a fuller notification within 72 hours, and a final report within 14 days of a corrective measure

Source

The CRA covers "products with digital elements": software whose foreseeable use involves a data connection. Mobile apps, desktop apps, browser extensions, Electron apps, plugins, firmware, container images — yes.

Source

The 24-hour clock does NOT start when you first hear a rumor. Per Commission guidance, it starts when an initial assessment gives you reasonable certainty of active exploitation or a severe incident

Source

One intake channel. A security@ address plus a SECURITY.md in every repo. The clock starts while you're searching inboxes if reports scatter.

Source