Security and vulnerability reporting
A public-safe status without claims of certification or unverified controls.
Vulnerability reporting
A monitored security email address, responsible owner and escalation rule must be tested before a production security.txt is published. Until then, the endpoint will report its not-ready status truthfully rather than provide a non-functional address.
Do not include real passwords, tokens, personal data or complete recordings in a vulnerability report. Describe the impact, reproduction steps and a secure method for further communication.
Security assurance
Prepared code or an internal checklist is not evidence that an operational control is working. Public launch remains blocked until production access review and MFA, a restoration test, monitoring, an incident exercise, a supplier register and an independent penetration test have been completed.
Catch Minutes is not described as CSA certified at this stage. STAR Level 1 is a public self-assessment and will be referenced only after it has actually been submitted and published in the registry.