Shipmark Join the free beta
How it works

Free tools

SBOM scanner Does the CRA apply? Reporting deadlines security.txt generator Support period GitHub Action

Learn

Guides CRA news Pricing FAQ Join the free beta

Shipmark / Free tools

security.txt and disclosure policy generator

An RFC 9116 security.txt file and a coordinated vulnerability disclosure policy for your apps, in two minutes.

The CRA asks every manufacturer to have a coordinated vulnerability disclosure policy and an easy way to report vulnerabilities, including a contact address (Annex I, Part II, points 5 and 6), and to make a single point of contact easy to find (Article 13(17)). ENISA's draft SME Vulnerability Kit recommends a security.txt file plus a published policy. This generator gives you both, ready to adapt.

Who receives reports

Use a role address that will outlive staff changes, and make sure someone reads it every working day.

What the policy covers

Choose times your team can really meet. ENISA's draft suggests acknowledging within 7 calendar days.

Optional

The generator runs in your browser and stores nothing. The policy is a starting template, not legal advice: safe harbour wording in particular depends on national law, so have it reviewed before you publish. Related: ENISA's draft SME Vulnerability Kit · CRA vulnerability reporting for app teams.