Enterprise reviewers read your security page before your pricing page. Here is what belongs on it.
A responsible disclosure policy costs an afternoon to publish and removes a recurring question from every enterprise review you will ever run.
Publish four things: a reachable security contact, a scope statement, a safe-harbor commitment for good-faith research, and a response-time expectation you can actually meet.
Pair it with a security.txt file at the well-known path so automated researchers find the contact without guessing.
Then treat it as an operational commitment. A policy with a promised 48-hour acknowledgement and no rotation behind it does more damage than no policy at all.
Buyers read this page as a proxy for engineering maturity. That is a fair reading, and it is cheap to earn.
Want this checked on your product?
We run the same review across privacy, consent, accessibility, AI disclosure, and public security surfaces — and ship the remediation.
Request an audit