Question 1

Does the CRA require a security.txt file?

Accepted Answer

No. It requires a CVD policy, a contact address for reports and a single point of contact (CRA Annex I Part II(5)–(6); Art. 13(17)). A security.txt makes those easy to find.

Question 2

Is a security.txt enough on its own?

Accepted Answer

No. It points to your contact and policy; you still need the policy itself, a process that handles reports, and the contact in your user information (CRA Annex II(2)).

Question 3

Can the single point of contact be a chatbot?

Accepted Answer

Not only a chatbot. Users must be able to choose their preferred means of communication, and the contact must not be limited to automated tools (CRA Art. 13(17)).

Question 4

Must I run a bug bounty?

Accepted Answer

No. Recital 76 says manufacturers "should be able to" use bug bounty programmes as part of their CVD policy (CRA Recital 76).

Question 5

Can I keep a fixed vulnerability quiet?

Accepted Answer

Only for a while, in duly justified cases where you consider the security risks of publication to outweigh the benefits, until users have had the chance to apply the patch (CRA Annex I Part II(4)).

Question 6

Do I need this before December 2027?

Accepted Answer

The CVD duties apply from 11 December 2027 (CRA Art. 71(2)). Since reporting already applies from 11 September 2026, a working intake channel now helps you learn of exploitation early.