Summary. This guide follows a vulnerability report from both ends: the researcher who found the flaw and the company that receives the report or a payment demand. Track A takes the researcher from the moment of discovery through stopping and documenting the testing, finding the right channel, getting advice, drafting the report, asking for compensation without conditioning silence, and publishing on a fixed timeline. Track B takes the company from intake and verification through evidence preservation, classifying the sender, the notification analysis, law enforcement and insurer decisions, response letters, and the difference between paying a bounty and paying an extortionist. Each step explains what to do, why, the governing authority, pitfalls, timing, and cost. A timeline and cost table, an extended worked example involving a pharmacy refill portal, common mistakes, an FAQ, and takeaways close the guide.

At 11:40 on a Saturday night, Tomas Reyes is refilling his own blood pressure prescription through the web portal of Calder Pharmacy Group, a regional chain with 140 stores. He is a backend developer by trade. Something on the confirmation screen looks wrong, and a moment later the portal is showing him a stranger's name, date of birth, and prescription instead of his own.

He closes the tab. Then he sits for a long time wondering what he has just done, whether he has committed a crime, and whether telling Calder will make things better or worse.

Thirty-six hours later, on Monday morning, Calder's general counsel, Marisol Vance, opens a message forwarded from the customer service inbox. It describes the flaw, says the writer "looked at one other record," and asks whether Calder has a bug bounty. An hour after that, a second message lands in the same inbox from an address Vance has never seen: We have 40,000 Calder patient records. We are prepared to keep this private. Our fee is 4 BTC. You have five days.

Both of them need to act. Neither has much time. This guide is the sequence for each.

The doctrine behind every step is explained in Paid Vulnerability Disclosure and the Line Between Research and Extortion. For a company building the program that would have routed Reyes's report to the right place, see the Vulnerability Disclosure Program and Safe Harbor Checklist: A Practical Checklist. The letters and agreements referred to below are in the Vulnerability Disclosure Toolkit: VDP Policies, Safe Harbor Terms, Researcher Agreements, and Response Letters.

The short answer

  • Researchers: stop, write it down, and delete. Further testing after discovery adds risk under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 and adds nothing to the report. A contemporaneous log and a deletion record are the two most valuable documents you will ever create in the matter.
  • Find the front door before you knock. Look for a vulnerability disclosure policy (VDP), a security.txt file, or a bounty program. If there is none, use a coordinator such as the CERT Coordination Center or send through counsel.
  • Give the company everything it needs to fix the flaw, unconditionally. Ask for compensation, if at all, separately and for identifiable value. Never tie the technical detail, the timeline, or your silence to payment. That linkage is what 18 U.S.C. § 875(d), 18 U.S.C. § 1030(a)(7), and the Hobbs Act, 18 U.S.C. § 1951, punish.
  • Companies: acknowledge, verify, preserve, and only then characterize. A neutral reply costs nothing. An accusatory one is usually wrong and always discoverable.
  • The notification clock is separate from the researcher conversation. If personal information was accessed, state breach laws, sectoral rules, contracts, and securities rules may each apply, and a payment or nondisclosure agreement satisfies none of them.
  • A bounty and an extortion payment are different transactions. One rewards a report delivered without conditions. The other buys silence from someone who took your data. The second requires counsel, law enforcement consideration, insurer consent, and a sanctions screen, and it must never be dressed up as the first.
  • Expect days, not months, for the first moves. The researcher's first contact and the company's acknowledgment should both happen within a few business days. The disclosure window is commonly 90 days.

Before you start: decision points

For the researcher

Question If yes If no
Were you authorized to access what you accessed (your own account, an in-scope VDP target, a contracted test)? Your main risk is the demand, not the access. Your access risk is real; get advice before first contact.
Did you retrieve anyone else's data? Stop, minimize, delete, and log. Expect the company to run a notification analysis. Say so expressly in the report; it is the most useful fact you can give.
Is there a published VDP or bounty program? Read the scope and rules and report through it. Consider a coordinator or counsel as the channel.
Is the affected system a third party's (cloud host, payment processor, SaaS vendor)? Report to the system owner, not just the customer. Proceed with the target.
Do you want to be paid? Plan the request so it is severed from the disclosure (Step A7). Say you are reporting without conditions.
Do you want to stay anonymous? Decide now how identity will be handled at the release stage (Step A5). Use your real name and a stable contact.

For the company

Question If yes If no
Does the report include enough technical detail to reproduce? Route to security for verification today. Ask for detail neutrally. Withholding is a warning sign.
Does the message condition detail, silence, or a deadline on payment? Treat as a potential extortion event (Steps B4, B6, B9). Treat as a research report.
Does it say data was taken, or do your logs show it? Start the notification analysis now (Step B5). Document why no notification is triggered.
Is the sender inside the scope of your VDP? Honor the safe harbor. Decide deliberately whether to extend it; do not threaten by reflex.
Are you public, regulated, or under an existing regulatory order or investigation? Bring in the disclosure and regulatory counsel immediately. Proceed with the standard sequence.

Track A: The researcher

Step A1: Stop testing and freeze the scope

What to do. Stop the moment you have confirmed the flaw exists. Do not "check how far it goes," do not script requests to count records, and do not try adjacent endpoints. If you have been blocked, rate-limited, logged out, or told to stop, treat that as final.

Why. Every additional request is additional "access" under § 1030(a)(2), and every additional record is additional information "obtained." The narrowing in Van Buren v. United States, 593 U.S. 374 (2021) helps people with authorized access who misuse it; it does nothing for access that was never authorized, and incrementing a record ID on someone else's account is at least arguably that. Revocation matters too. In Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016), continued access after a cease and desist letter and IP blocking was unauthorized, and in United States v. Nosal, 844 F.3d 1024 (9th Cir. 2016), using borrowed credentials after revocation was a crime.

Pitfalls. "Assessing scope" by sampling is the most common way a minor finding becomes a serious problem. It also multiplies the company's notification burden, which makes the company less friendly.

Timing and cost. Immediate. Free.

Step A2: Document what you did, then delete what you took

What to do. Write a dated, plain-language log while your memory is fresh: the date and time (with time zone), your IP address and device, the URL or endpoint, each request you made, what came back, and why you made it. Capture a screenshot or response body only to the extent needed to prove the flaw, redacting another person's data in the copy you keep. Then delete any other person's data you hold, and record what you deleted, where it was stored, how you deleted it, and when.

Why. The log supports a good-faith characterization under the Department of Justice's 2022 CFAA charging policy (Justice Manual 9-48.000), which turns on whether research was "carried out in a manner designed to avoid any harm." The deletion record answers the company's first question and can determine whether the company has a reportable breach. If you circumvented a technical protection measure on software or a device, the DMCA security research exemption at 37 C.F.R. § 201.40(b) likewise requires research in an environment designed to avoid harm and information used primarily to promote security.

Pitfalls. Do not reconstruct the log weeks later and present it as contemporaneous. Do not keep "just one copy" of the dataset. Do not delete your own notes about what you did; those are the log.

Timing and cost. Same day. A few hours of your time.

Step A3: Find the front door

What to do. Look in this order: https://[domain]/.well-known/security.txt (the location standardized by RFC 9116), the legacy /security.txt, a "security," "responsible disclosure," or "trust" page, the major bounty platforms, and the company's product documentation. Read the policy in full: scope (which domains, apps, and versions), prohibited methods (social engineering, denial of service, automated scanning, data access), the safe harbor language, the disclosure timeline, and whether rewards are offered.

Why. A VDP is the system owner's authorization. Testing inside it removes the central CFAA problem prospectively, and many policies also waive claims under state computer crime laws and § 1201. If your testing was outside scope, the policy still tells you where to report and what the company has promised about researchers who report in good faith.

Pitfalls. Third-party infrastructure is the classic trap. A storage bucket hosted by a cloud provider or a widget served by a vendor may be outside the target's power to authorize. Bounty platform terms add their own obligations, including confidentiality, and breaching them can forfeit any reward and the platform's safe harbor.

Timing and cost. An hour. Free.

Step A4: Choose the channel

What to do. Pick one of four channels.

  1. The company's VDP or bounty platform, if there is one and the finding fits it.
  2. A direct email to a named security contact from security.txt.
  3. A coordinator. The CERT Coordination Center at Carnegie Mellon accepts reports through its VINCE platform and coordinates with vendors, with a published default of public disclosure 45 days after the initial report, adjusted for circumstances. CISA coordinates reports involving industrial control systems and federal systems. Sector information sharing and analysis centers can help reach the right people in health care, finance, and energy.
  4. Counsel, who can send the report on your behalf, with or without disclosing your identity.

Why. A coordinator puts a neutral third party in the middle, documents what was disclosed and when, and removes the appearance that the timeline is yours to bargain with. Counsel adds advice and a buffer.

Pitfalls. Do not report to the company's customer service line, social media, or a random employee. The message will be misrouted, and the first person who reads it is the least equipped to understand it. Do not report through more than one channel without telling each of them.

Timing and cost. A coordinator is free. Counsel's review of a first contact is usually a few hours of time.

Step A5: Get advice before first contact

What to do. If your access was arguably unauthorized, if you saw anyone else's data, or if you want to be paid or stay anonymous, talk to a lawyer before you send anything. Bring the log, the deletion record, and the draft report.

Why. The first message is the document that will be read most carefully if anything goes wrong. A lawyer can tell you which state's computer crime law may apply, whether a § 1201 issue exists, and how to word the compensation request. Communications with counsel for legal advice are privileged under Upjohn Co. v. United States, 449 U.S. 383 (1981) and Fed. R. Evid. 501, but your identity and the fact of the engagement usually are not, and the crime-fraud exception recognized in United States v. Zolin, 491 U.S. 554 (1989) can open the file if the demand is later treated as extortion.

Pitfalls. Expecting the lawyer to make an unauthorized access authorized. Expecting anonymity to survive a subpoena or the company's insistence on knowing who it is releasing. Choosing a lawyer who will send whatever you write; the value is in the one who will not.

Timing and cost. One or two days. Commonly a fixed fee or a few hours of attorney time for review and a single first-contact letter, more if anonymity or a negotiated agreement is involved.

Step A6: Draft the report

What to do. Write a report that would let a competent engineer at the company reproduce and fix the flaw without contacting you. Include:

  • A one-paragraph summary in plain English.
  • The affected asset (URL, app, version, endpoint) and when you observed the issue.
  • A description of the issue at the level of detail the company's engineers need, written so that it does not double as a public attack guide if it is forwarded.
  • Your assessment of impact and severity, with your reasoning, and an honest statement of what you do not know.
  • Exactly what data, if any, you saw or retrieved, whose it was (by category, not by name), and what you did with it, with the deletion record attached.
  • The disclosure timeline you follow, stated once.
  • How to reach you, and whether counsel is involved.

Why. A complete report goes to engineering. A partial one goes to legal. The minimization statement is the single most useful fact in the message, because it lets the company scope its notification analysis on day one.

Pitfalls. Exaggerating severity to make the finding look bigger. Speculating about the company's negligence. Including another person's data in the report itself. Sending the report as a link to a file host that the company's mail filters will block.

Timing and cost. A few hours.

Step A7: Ask for compensation, if at all, without conditioning anything

What to do. If the company runs a bounty program, submit through it and accept its rules, including its reward tiers. If it does not, you may ask for compensation, but in a separate paragraph or a separate message, after the report has been delivered, and framed around identifiable value: the hours you spent, a mutual release, your agreement not to test further, and help verifying the fix. State expressly that the report is provided unconditionally and that your timeline does not depend on the answer.

Why. The extortion statutes turn on linkage. Section 875(d) punishes a communication containing a threat to injure reputation sent "with intent to extort." Section 1030(a)(7)(B) reaches a threat "to impair the confidentiality of information obtained from a protected computer without authorization," which describes an offer to keep stolen data private for a fee. The Hobbs Act, § 1951(b)(2), defines extortion as obtaining property through the "wrongful use" of fear, including fear of economic loss. 18 U.S.C. § 873 separately reaches demands made "as a consideration for not informing" against a violation of federal law. Courts look at structure, not vocabulary: the Second Circuit's decision in United States v. Jackson, 180 F.3d 55 (2d Cir. 1999) asks whether a reputational threat is tied to a plausible claim of right, and United States v. Avenatti, 81 F.4th 171 (2d Cir. 2023) affirmed the conviction of a lawyer who demanded to be hired, at a self-set fee, to investigate the misconduct he threatened to publicize.

Pitfalls. Holding back any part of the technical detail "pending terms." A short deadline. Any mention of regulators, journalists, or customers in a message that also discusses money. A demand to be retained as a consultant to fix the problem you are threatening to expose. A pattern of identical letters to many companies, which the DOJ policy's carve-out for research done "to extort the owners" was written to catch.

Timing and cost. Only after the report has been delivered and acknowledged. Accept that the answer may be no.

Step A8: Keep the timeline fixed and publish responsibly

What to do. State a disclosure date at the outset (90 days from the report is the common default; CERT/CC uses 45 days as a starting point) and keep it regardless of what happens in any compensation conversation. Offer to extend it if the company shows it is actively remediating. Before you publish, give the company advance notice of the date and a copy of the advisory text. Coordinate on a CVE identifier, either through the vendor if it is a CVE Numbering Authority or through a coordinator. Publish enough for defenders to understand and detect the issue; consider carefully whether to publish working proof-of-concept code at all.

Why. A timeline that runs regardless of payment is a coordinated disclosure norm. A timeline that shortens when the company declines to pay is leverage. If the research involved circumvention of a technical protection measure, publishing a tool that does the circumventing raises separate trafficking issues under 17 U.S.C. § 1201(a)(2) and (b), which the Second Circuit enforced against code publication in Universal City Studios, Inc. v. Corley, 273 F.3d 429 (2d Cir. 2001). The security research exemption covers the act of circumvention, not the distribution of tools.

Pitfalls. Publishing personal data, even redacted badly. Publishing because the company refused to pay, and saying so. Publishing before the date you gave.

Timing and cost. The disclosure window, plus a few hours to prepare the advisory.

Step A9: If the company threatens you

What to do. Do not respond in anger and do not publish in retaliation. Stop all access to the company's systems if you have not already. Preserve your log, your correspondence, and your deletion record. Get counsel, who can answer the letter, offer the facts that show good faith, and, if the company has a VDP you complied with, point to its safe harbor.

Why. A civil CFAA claim under § 1030(g) requires one of the statutory harms, usually "loss" of at least $5,000 in a year, and must be brought within two years. "Loss" includes the cost of responding to the offense and assessing damage, as defined in § 1030(e)(11), so a company's investigation costs can satisfy the threshold. State statutes such as Cal. Penal Code § 502 have their own civil actions. A measured response is how these threats usually end; the strategy for the response itself is in Responding to a Cease and Desist Letter: A Practical Guide.

Pitfalls. Public commentary while the dispute is live. Deleting the log to "protect yourself," which can look like spoliation. Assuming the DOJ charging policy protects you from a civil suit or a state prosecutor; it does neither.

Timing and cost. Respond within the time the letter asks, or ask for a short extension through counsel.

Track B: The company

Step B1: Acknowledge and route

What to do. Send a neutral acknowledgment within one business day: thank the sender, confirm receipt, give a ticket or case number and a named contact, say when to expect a substantive reply, and ask for any missing technical detail. Route the report to the security owner and copy legal. Do not say anything about legal consequences, rewards, or whether you believe the sender acted lawfully.

Why. The acknowledgment keeps a researcher inside a cooperative process and buys verification time. Nothing in it can be used as a threat, a promise, or an admission. ISO/IEC 29147 treats prompt acknowledgment as a basic element of disclosure handling, and the published service levels in most VDPs make it a commitment.

Pitfalls. An automated reply that says nothing. A reply from a salesperson or support agent. A reply that promises a reward before anyone knows whether the report is real.

Timing and cost. Same or next business day. Minutes.

Step B2: Verify and triage

What to do. Have the security team reproduce the issue in a controlled way, confirm the affected systems and versions, determine whether it was already known, rate severity (most teams use the CVSS scoring system maintained by FIRST), and decide whether the reporter's testing was inside or outside any published scope. Contain first if the flaw exposes personal data: a temporary fix or feature shutdown can usually precede the permanent patch.

Why. Verification converts a message into facts. Whether the sender accessed data, how much, and whose, determines both whether you have a reportable incident and how to characterize the sender.

Pitfalls. Letting engineers fix the bug before logs are preserved (Step B3). Treating "we could not reproduce" as the end of the matter without asking the reporter for help.

Timing and cost. Hours to a few days, depending on severity and complexity. Internal staff time.

Step B3: Preserve the evidence

What to do. Preserve the relevant web, application, authentication, and access logs for the period around the reported activity, plus the report and all correspondence, before routine rotation deletes them. Issue a written hold to the people and systems involved. Identify, from the logs, what records were actually accessed and by which source.

Why. The logs are the only independent check on the reporter's account and on the second email's claims. They decide the notification question, any civil claim, and any referral. Litigation is reasonably anticipated once a demand arrives, which triggers preservation duties that the courts enforce through Fed. R. Civ. P. 37(e) sanctions and that shape the scope of discovery under Rule 26. Do the work under counsel's direction so that the analysis has the best chance of work-product protection.

Pitfalls. Engaging an outside forensic firm directly rather than through counsel, which has cost companies privilege over forensic reports in data breach litigation. Overwriting the evidence by fixing the bug in place.

Timing and cost. Same day. Storage cost is trivial; forensic support, if needed, is a significant expense usually covered under a cyber policy if notice is timely (Step B7).

Step B4: Classify the sender

What to do. Read the message against four features:

Feature Research report Extortion event
Technical detail Delivered Withheld pending payment
Deadline Remediation window, extendable Short, tied to payment
Payment Absent, or requested separately for value delivered The price of silence or deletion
Data None, or minimal and deleted Bulk data held, with proof samples

Most messages land clearly in one column. Some are mixed: a real researcher who wrote a clumsy email. For those, answer the clumsy email as if it were the good one, and give the sender a chance to clarify.

Why. The two columns have different playbooks. Treat a researcher as an extortionist and you create an adversary and a news story. Treat an extortionist as a researcher and you may pay a criminal, mislead a regulator, and repeat the Uber fact pattern discussed in the companion article.

Pitfalls. Deciding on tone rather than structure. A polite extortion note is still extortion, and a rude researcher is still a researcher.

Timing and cost. Within the first day. Counsel time.

Step B5: Run the notification analysis on its own clock

What to do. Determine whether personal information, as each applicable law defines it, was acquired or accessed by an unauthorized person, and if so which notification obligations are triggered, to whom, and by when. Document the analysis either way.

Why. The obligations are independent of the researcher conversation. The main sources:

Regime Trigger (summary) Clock
State breach statutes, e.g., Cal. Civ. Code § 1798.82 Unauthorized acquisition of defined personal information; some states apply a risk-of-harm test "Most expedient time possible" or a fixed number of days, varying by state
HIPAA breach notification, 45 C.F.R. §§ 164.400-414 Unsecured PHI acquired, accessed, used, or disclosed impermissibly, presumed a breach unless a four-factor risk assessment shows a low probability of compromise Without unreasonable delay, no later than 60 days after discovery
FTC Safeguards Rule, 16 C.F.R. § 314.4(j) Unencrypted customer information of at least 500 consumers acquired without authorization (non-bank financial institutions) No later than 30 days after discovery, to the FTC
FTC Health Breach Notification Rule, 16 C.F.R. part 318 Vendors of personal health records and related entities not covered by HIPAA Generally 60 days
Bank regulators, 12 C.F.R. part 53 and counterparts A "notification incident" materially disrupting operations As soon as possible, no later than 36 hours
SEC, Form 8-K Item 1.05 and 17 C.F.R. § 229.106 A cybersecurity incident determined to be material Four business days after the materiality determination
NYDFS, 23 NYCRR 500.17 Cybersecurity events meeting the regulation's criteria, plus any extortion payment 72 hours; 24 hours for an extortion payment
Contracts Customer agreements, data processing agreements, payment card rules Often 24 to 72 hours

A researcher's documented assurance of deletion is a relevant fact. Under HIPAA, for example, the risk assessment considers the extent to which the risk has been mitigated, which can include satisfactory assurances from the recipient. It is not a substitute for the analysis. The fifty-state detail is in Data Breach Response and Notification: The Fifty-State Patchwork, Regulators, and Litigation, the sectoral regimes in Cybersecurity Regulation for Businesses: The FTC Safeguards Rule, NYDFS Part 500, SEC Cyber Disclosure, and State Laws, and the first-hours sequence in Responding to a Data Breach: The First Seventy-Two Hours.

Pitfalls. Waiting for the researcher negotiation to finish. Treating an NDA with the researcher as if it changed the facts. Concealing an incident from a regulator that is already investigating you: the obstruction and misprision convictions of Uber's former chief security officer, under 18 U.S.C. § 1505 and 18 U.S.C. § 4, rested on exactly that.

Timing and cost. Start on day one. Privacy counsel time; notification costs if triggered.

Step B6: Decide about law enforcement

What to do. For an extortion event, consider a report to the FBI (through a field office or the Internet Crime Complaint Center) or the Secret Service. For a genuine research report, a referral is rarely appropriate and should never be threatened as leverage. Decide who makes the call, what is shared, and how the referral is documented.

Why. Law enforcement may already know the actor, may be able to help with attribution or recovery, and a documented early report is a factor regulators and OFAC weigh favorably when a payment is considered. The federal incident reporting regime for critical infrastructure under the Cyber Incident Reporting for Critical Infrastructure Act, 6 U.S.C. § 681 and following, will add mandatory reports of covered incidents (within 72 hours) and ransom payments (within 24 hours), but only once CISA's implementing rule is final and effective; CISA published the proposed rule in April 2024, so check whether the final rule has issued.

Pitfalls. Telling a researcher that you "have referred this to the FBI" as a negotiating move. Some state ethics rules forbid a lawyer from threatening criminal charges to gain advantage in a civil matter, and the threat poisons a cooperative relationship.

Timing and cost. Within the first days of an extortion event. No direct cost.

Step B7: Notify the insurer

What to do. Read the cyber policy's notice provision and its cyber extortion coverage, give notice as the policy requires, and obtain written consent before incurring any extortion expense or engaging vendors you expect the policy to pay for.

Why. Many cyber policies condition extortion coverage on prior consent and require use of panel vendors. Late notice or a voluntary payment can forfeit coverage. The insurer may also bring an experienced incident response and negotiation team. The coverage mechanics are in Placing and Tendering a D&O or Cyber Claim: A Practical Guide.

Pitfalls. Assuming a bounty payment to a researcher is covered (it usually is not, and usually does not need to be). Assuming a payment to an extortionist is covered without consent.

Timing and cost. Within the policy's notice period, often "as soon as practicable."

Step B8: Send the right response letter

What to do. Choose one of three responses.

  1. The research report. Confirm the finding, give a remediation estimate, ask the researcher to keep the details confidential until a stated date tied to the fix, address any reward request (yes, no, or "let us discuss"), and, if the researcher was within your VDP or you choose to extend it, confirm in writing that you will not pursue claims.
  2. The clumsy email. Thank the sender, say that you are treating the report as a good-faith disclosure, ask for the technical detail and confirmation of what data was accessed and deleted, and explain that you do not pay for information held back or for silence but will consider compensation for a report delivered without conditions.
  3. The extortion demand. Short, factual, and written with counsel and, where engaged, law enforcement: you do not acknowledge the demand as a bounty submission, you ask for proof of what is held, you do not commit to anything, and you preserve every message.

Why. Each letter will be read later by someone else: a regulator, a judge, a reporter, a jury. Accusations of crime by a lawyer can raise professional responsibility issues under state analogs of ABA Model Rules 4.4 and 8.4 and the rules descended from former Disciplinary Rule 7-105, and a threat paired with a demand that the sender stay silent can look like the very coercion you are complaining about. Templates for all three letters are in the Vulnerability Disclosure Toolkit: VDP Policies, Safe Harbor Terms, Researcher Agreements, and Response Letters.

Pitfalls. A "we reserve all rights" paragraph that reads as a threat in a letter that should be a thank-you. Signing anything with an extortionist that recites facts you know to be false, as the Uber nondisclosure agreements did.

Timing and cost. Within the time promised in the acknowledgment. A few hours of counsel time.

Step B9: Pay a bounty, or decide about an extortion payment

What to do. For a researcher, pay under written terms: the amount, the scope of the finding, a mutual release, a covenant not to test further outside an agreed scope, cooperation on retesting, confidentiality until a date tied to remediation, and a carve-out preserving everyone's right to talk to regulators and law enforcement. Collect identity and tax information as your finance team requires. Screen the payee against the Treasury Department's sanctions lists.

For an extortion demand, treat any payment as a separate, board-level decision: counsel, insurer consent, law enforcement consultation, a sanctions analysis under the International Emergency Economic Powers Act, 50 U.S.C. §§ 1702 and 1705, and the cyber-related sanctions regulations at 31 C.F.R. part 578, and documented reasons. Do not process it through the bounty program, and do not paper it as one.

Why. OFAC liability for prohibited transactions is strict, and OFAC's ransomware advisories tell companies that cooperation with law enforcement and prompt reporting are mitigating factors. Confidentiality terms must not impede communications with regulators: the SEC's Rule 21F-17 prohibits enforcing confidentiality agreements to stop someone from reporting possible securities violations to the Commission. The release itself should follow ordinary settlement drafting; see Drafting a Settlement Agreement and Release: A Practical Guide. The payment decision for data-theft extortion is analyzed in Ransomware and the Payment Decision: OFAC Sanctions, Reporting Duties, Insurance, and Negotiating With Attackers.

Pitfalls. A confidentiality clause with no regulatory carve-out. A release that recites "no data was accessed" when some was. A payment above the published bounty tiers, routed through the bounty platform, to someone who took data: that is the Uber pattern.

Timing and cost. Bounty payments typically follow verification and remediation. Amounts vary widely by program and severity.

Step B10: Remediate, credit, and close

What to do. Fix the flaw, let the researcher verify the fix if offered, publish an advisory or release note where users need to act, coordinate the CVE identifier, credit the researcher if they want credit, and close the file with a short memo recording the facts, the notification decision, the payment decision, and what changes to the program are needed. If you had no VDP, publish one.

Why. The closing memo is the document you will want when the next report arrives, when an auditor asks about your vulnerability management, or when a regulator asks why you did not notify. The program-building tasks are in the Vulnerability Disclosure Program and Safe Harbor Checklist: A Practical Checklist, and the advisory and severity templates for device makers are in the Product Security Toolkit: SBOMs, Vulnerability Disclosure, and Recall Decisions.

Pitfalls. Silently fixing the flaw and ignoring the researcher, which is the most common reason researchers publish early. Failing to tell the researcher when the fix ships.

Timing and cost. Remediation time depends on severity; many programs target days for critical issues and weeks to months for lower severity.

Timeline and cost at a glance

When Researcher Company Typical cost
Day 0 Stop, log, delete (A1, A2) (Unaware) None
Days 0 to 2 Find the front door; choose a channel (A3, A4) None
Days 1 to 5 Counsel review of first contact (A5, A6) A few hours of attorney time
Day of report Send report unconditionally Acknowledge within one business day (B1) Minutes
Days 1 to 7 Answer follow-up questions Verify, preserve, classify (B2 to B4); start notification analysis (B5) Internal time; forensic support if data was taken
Days 1 to 10 Insurer notice and law enforcement decision for extortion events (B6, B7) Policy retention may apply
Days 5 to 30 Compensation discussion, if any, separately (A7) Response letter (B8); bounty or payment decision (B9) Bounty amount; counsel time for agreement
Within regulatory clocks Notifications, if triggered Varies widely
Day 45 to 90 (or as extended) Publish advisory on the fixed date (A8) Remediate, credit, advisory, close-out memo (B10) Engineering time

Worked example: the pharmacy portal

Return to Calder Pharmacy Group and the two Monday messages.

Reyes, Saturday night through Tuesday. Reyes stopped after the one stranger's record appeared. He wrote a log that night: the time, his home IP address, the page he was on, and the fact that he saw one other patient's name, date of birth, and medication. He had taken a screenshot; he redacted the other patient's details in a copy, deleted the original, and recorded the deletion. On Sunday he found no security.txt file and no disclosure page on Calder's site. He did find that the portal was built and hosted by a pharmacy software vendor, which he noted. On Monday morning he spent an hour with a lawyer, who told him three things: that his access was arguably unauthorized but minimal and well documented; that he should report to both Calder and the vendor, or through a coordinator; and that if he wanted a reward he should ask for it in a separate message after the report, not in it.

Reyes had already sent a short note to Calder's customer service address on Sunday, which was the forwarded message Vance saw. On his lawyer's advice he followed up Tuesday with the full report, sent to Calder's general counsel and to the vendor's security contact, stating that it was provided without conditions, describing what he had seen and deleted, and stating a 90-day disclosure timeline that he would extend if remediation was under way. He said nothing about money. Two weeks later, after Calder confirmed the fix, his lawyer asked whether Calder would consider a payment for his time.

Calder, Monday through day 30. Vance acknowledged Reyes's Sunday note within the hour and opened a ticket. Calder's CISO, Ben Achterberg, had the vendor reproduce the flaw by Monday afternoon and switch off the affected feature that evening. Achterberg preserved the portal's access logs for the prior 90 days before the vendor deployed anything.

The logs told two stories. Reyes's account had touched exactly one record other than his own, at the time his log said. A different source, a commercial hosting provider abroad, had made tens of thousands of requests across the same feature over the previous three weeks. That was the second email.

Vance classified the two messages separately. Reyes's was a research report: detail delivered, no deadline, no demand, minimal data, deletion documented. The second was an extortion event: data taken in bulk, silence offered for a price, a five-day deadline.

The notification analysis ran on its own track with outside privacy counsel. Calder is a HIPAA covered entity, so the presumption of a breach applied to both. For the one record Reyes saw, counsel's four-factor risk assessment concluded that the probability of compromise was low: one record, viewed by an identified person, who gave written assurance and a deletion record. Calder documented that conclusion. For the bulk access, there was no such conclusion to reach. Calder notified affected patients, HHS, the media where the HIPAA thresholds required it, and the states whose statutes applied, within the HIPAA 60-day outer limit and earlier where state law required.

Calder gave notice to its cyber insurer on Monday, reported the extortion demand to the FBI field office on Tuesday, and did not answer the extortion email beyond a single message, drafted with counsel, asking for proof of what was held. It never paid. Its sanctions analysis was never needed.

Vance answered Reyes's compensation request yes: $3,000 under a short researcher agreement, with a mutual release, a covenant not to test Calder systems outside a future VDP, a confidentiality period ending at the earlier of 30 days after the fix or the original 90-day date, and a carve-out for communications with regulators. Calder screened the payment, collected tax information, and paid through accounts payable. Reyes published a short advisory on day 60, with the vendor's agreement and without any patient data, crediting Calder and the vendor for a fast fix. Calder published a VDP and a security.txt file in month three.

The point of the example is the separation. The same Monday brought a researcher and an extortionist through the same flaw. Calder treated them differently because it looked at the structure of each message and at its own logs, and it ran the notification analysis on facts rather than on either sender's account.

Common mistakes

Researchers

  • Continuing to test after discovery "to understand the scope."
  • Keeping another person's data, even "securely."
  • Reporting to customer service or social media instead of a security contact.
  • Putting the compensation request in the report, or holding back detail until it is answered.
  • Mentioning regulators, the press, or customers in any message about money.
  • Moving the disclosure date because the company said no to payment.
  • Publishing tools or data instead of an advisory.

Companies

  • Replying with a legal threat before verifying the facts.
  • Fixing the bug before preserving the logs.
  • Waiting for the researcher conversation to end before starting the notification analysis.
  • Paying an extortionist through the bounty program, or with an NDA that misstates the facts.
  • Forgetting the insurer's consent requirement.
  • Using confidentiality terms that would stop someone from talking to a regulator.
  • Ignoring the researcher after the fix, which invites early publication.

Frequently asked questions

I found the flaw by accident while using my own account. Am I in trouble? Probably not, if you stopped promptly, took nothing beyond what appeared, deleted it, and report it cleanly. The risk grows with each additional request and record, and with any demand tied to silence.

There is no security contact anywhere. Who do I tell? Use a coordinator such as CERT/CC, report to the hosting vendor if the system is a vendor's, or send through counsel. Avoid customer service channels and public posts.

Can I ask for a bounty when the company has no bounty program? Yes, after the report has been delivered unconditionally and in a separate message, framed around the value delivered. Accept a refusal.

What if the company never responds? Follow up through a second channel or a coordinator. Keep to your published timeline, give advance notice before publishing, and publish an advisory rather than data or tools.

We received a report from someone who was outside our VDP's scope. Do we have to honor the safe harbor? Not as a matter of the policy's terms, but you can extend it, and usually should for a good-faith report. Decide deliberately and say so in writing.

Does paying a researcher mean we do not have to notify? No. Notification depends on whether personal information was accessed or acquired by an unauthorized person under each applicable law. The researcher's documented minimization and deletion may support a no-notice conclusion under some regimes, but the payment itself is irrelevant.

Should we sign an NDA with the researcher? A time-limited confidentiality term tied to remediation is normal. It must not misstate facts, must carve out communications with regulators and law enforcement, and must not be used to conceal a reportable incident.

What do we do if a "researcher" turns out to have taken bulk data? Reclassify the matter as an extortion event: preserve, involve counsel, notify the insurer, consider law enforcement, run the notification analysis, and treat any payment as a separate decision with a sanctions screen. For the playbook, see Responding to a Ransomware Attack: A Practical Guide for the First Two Weeks and the Ransomware Response Toolkit: Decision Memos, Sanctions Screening Records, and Notification Templates.

Key takeaways

  • For researchers: stop, log, delete, find the front door, get advice, deliver the report unconditionally, ask for compensation separately or not at all, and keep a fixed timeline.
  • For companies: acknowledge, verify, preserve, classify by structure, run notification on its own clock, involve the insurer and law enforcement for extortion, and respond in writing you would be comfortable showing a regulator.
  • A bounty rewards a report delivered without conditions. An extortion payment buys silence. Never let the paperwork for one describe the other.
  • Publish a VDP. It is the cheapest way to make every step of this guide easier for both sides.

This document is general information, not legal advice for any particular situation; the law changes, and the facts matter.

Related Documents

Related Articles

Related Guides

Related Checklists

Related Toolkits