What Is security.txt, and Does the Cyber Resilience Act Require One?
Last reviewed: 29 October 2026. General information, not legal advice. If someone finds a security flaw in your website or app, they need a quick…
Category: Cyber Resilience Act
The EU Cyber Resilience Act sets security obligations for anyone placing a product with digital elements on the EU market — including app and software teams who have never thought of themselves as manufacturers. These articles cover what the regulation actually requires, who it catches, and what needs to be in place before the reporting obligations bite.
Tools in this cluster
Connected-Device Readiness ExplorerWho publishes a route to report a security flaw, who states a support period, who protects their domain — searchable by country, category or brand.OpenCRA Scope Checker for App TeamsFive questions that tell you whether the EU Cyber Resilience Act applies to your product, and which obligations follow if it does.Open
Articles
How to Report a Security Vulnerability in a Smart Device: We Found No Published Way for 7 in 10 Apps We Could Check
Last reviewed: 29 October 2026. General information, not legal advice. If your smart camera, doorbell or baby monitor does something that looks like a security…
Vendor Security Requirements: What 7 Buyers Ask Suppliers For
Last reviewed: 26 October 2026. General information, not legal advice. If you sell software, an SDK or a component to big customers, some of them…
CRA SBOM Requirements: What the Law Asks For and What It Doesn’t
Last reviewed: 26 October 2026. General information, not legal advice. If your app or connected product falls under the EU’s Cyber Resilience Act (CRA), you…
Who Do You Tell About a Flaw in Your App’s SDKs? We Checked 43
Last reviewed: 26 October 2026. General information, not legal advice. If your app is in scope of the EU’s new security law for software and…
CRA Reporting Obligations: A 24-Hour Runbook for App Teams
Last reviewed: 26 October 2026. General information, not legal advice. If attackers are exploiting a security flaw in your app, EU law may give you…
Cyber Resilience Act Timeline: Every CRA Date, and What Applies When
Last reviewed: 25 October 2026. Dates checked against the Official Journal text of the Regulation on 25 October 2026. General information, not legal advice. If…
Will Your Chip Maker’s PSIRT Warn You About a Flaw? We Checked 40
Last reviewed: 26 October 2026. General information, not legal advice. When your chip’s firmware or SDK has an exploited flaw, the EU’s 24-hour reporting clock…
Vulnerability Disclosure Programmes: We Found a Response Time at 14 of 144 Top-Grossing iPhone Publishers in Four European App Stores
Last reviewed: 25 October 2026. General information, not legal advice. When someone finds a security flaw in your app, they need to know where to…
Dependabot Has Nothing to Flag on 10 Exploited Flaws for Native Android and iOS Projects
Last reviewed: 25 October 2026. General information, not legal advice. If you build a native Android, iPhone or Flutter app, GitHub’s dependency alert tool may…