How to Triage Security Vulnerability Reports Without Dropping the Ball

## The Worst Way to Handle a Security Report

Ignore it. Let it sit in a support queue for two weeks. Then the researcher publishes it on Twitter, and you're scrambling.

This happens more often than you'd think. Security reports arrive through weird channels: the general support inbox, a LinkedIn message, a GitHub issue, a random form submission. If your support team doesn't know what a security report looks like, it gets treated like a normal ticket and waits its turn.

Don't let this happen.
...