The EU put a 24-hour clock on your side project's vulnerabilities

说明与用途

在欧盟发布软件的开发者必须在24小时内报告活跃的漏洞。建议的工作流程包括单一接收渠道、快速评估清单、预先编写的报告模板、ENISA平台准备和证据日志。

问题

Solo developers shipping software into the EU must report actively exploited vulnerabilities or severe incidents within strict timeframes under the EU Cyber Resilience Act, but many lack understanding and processes.

结果

Implementing the outlined workflow enables solo developers to meet CRA reporting deadlines, avoid credibility loss with CSIRTs, and maintain user trust.

工作流

• Create a dedicated security@ email address and add a SECURITY.md to every repo.
• Develop a 15‑minute triage checklist to determine product scope, evidence of active exploitation, and user impact.
• Draft early warning, 72‑hour notification, and user notice templates in advance.
• Set up EU Login accounts for yourself and a backup person; determine CSIRT routing via the decision tree if no EU establishment.
• Maintain a dated evidence log with product inventory, role per product, intake records, and filing timestamps.

证据

If you ship software into the EU, you are now a "manufacturer" with a legal clock: an early warning within 24 hours of becoming aware of an actively exploited vulnerability or severe incident, a fuller notification within 72 hours, and a final report within 14 days of a corrective measure

来源

The CRA covers "products with digital elements": software whose foreseeable use involves a data connection. Mobile apps, desktop apps, browser extensions, Electron apps, plugins, firmware, container images — yes.

来源

The 24-hour clock does NOT start when you first hear a rumor. Per Commission guidance, it starts when an initial assessment gives you reasonable certainty of active exploitation or a severe incident

来源

One intake channel. A security@ address plus a SECURITY.md in every repo. The clock starts while you're searching inboxes if reports scatter.

来源