So it's a fairly simple question. When offering an avenue to security researchers for communication with us regarding disclosure of security vulnerabilities, what's the best way to do so?
Assume we have a responsible disclosure policy page that's secured under a properly configured SSL/TLS connection:
- Offer a
security@email address to contact with a PGP with an established Web of Trust consisting of developers and open source community. The PGP fingerprint is published on the page and the key is available on one of the many key servers.
- Offer a HTTPS submission form that, under the hood, dispatches an email from the webserver to the office's internal mail system. STARTTLS would be used so the email is encrypted in-transit
- Offer both, letting the researcher decide.
It would seem to me that Option 3 is the best, but I've heard researchers complain about all 3 options both for & against.