As a conscientious programmer, I put security as one of the core requirements of every product I develop. To prevent flaws from being introduced, I promote a culture of awareness (e.g. make sure that team members I work with know about common vulnerability types), keep myself updated by regularly reading specialized sites (e.g. The H Security or Dan Kaminsky's blog), watch out for common mistakes (and discuss them if necessary) while performing code reviews.
However, we all know that, by Murphy's Law, a security bug will appear (sooner or later). My (closely related questions) are:
- How can I promote responsible disclosure of security vulnerabilities found by researchers? That is, how can I encourage them to collaborate jointly with me, not releasing details until a fix is prepared, while simultaneously ensuring they feel they are respected for their hard work and they get the credit they deserve?
- In case someone takes the full disclosure route, how can I react (be alerted of the vulnerability as soon as possible and then take appropriate mitigation measures) in the most timely and effective way?
At the moment, I've thought about:
- making sure a security contact is clearly listed on my website
- using CVE Details to get a feed for my products if they get published there
- following security mailing lists as well (see this IT Security answer)
- ensuring patches are prepared quickly
- constantly communicating with the bug reporter(s), updating them as progress is being made
- publicly crediting the researcher(s) for her/their discovery
- allowing full disclosure some time after the patches are published (to allow affected clients to install them)
(I'm part of a small team in a sort of startup, therefore my course of action is not limited by managerial issues. Nevertheless, I still think that any advice you'll provide can be applied to other situations as well.)