Describe your product and triage needs. Makeform creates a responsible-disclosure form for affected assets, reproducible steps, evidence, impact, and researcher contact.
Route new reports to email, Slack, Google Sheets, and Zapier.
Sample prompts for the builder
Choose a starting point, tailor the language, or send the prompt to the Makeform builder. Each structure is an example you can edit.
Audience
Independent researchers reporting issues in a web application
Format
Technical intake with conditional evidence fields
Prompt size
305 chars
Example form structure
Technical intake with conditional evidence fields
Researcher name or alias and contact email
Affected URL, product area, and version
Vulnerability category
Exact steps to reproduce
Redacted proof of concept
Suggested routing tags
Needs triage
Reproduction needed
Researcher follow-up
Ask researchers to replace live credentials, tokens, and personal data with redacted examples before uploading evidence.
Step 1
Receive
scope, asset, version, and researcher contact
Step 2
Reproduce
prerequisites, steps, requests, and evidence
Step 3
Triage
impact, affected users, and internal owner
Step 4
Respond
acknowledgment, follow-up, and status updates
Better disclosure intake
A dedicated form separates security findings from support tickets and asks for the technical context triage needs.
Separate prerequisites, numbered steps, and results so an engineer can retry the finding.
Place redaction reminders beside evidence fields and warn against secrets or unnecessary personal data.
Use component and vulnerability type to route reports and researcher follow-up.
Designed around the target
Conditional sections collect target-specific context while preserving common triage fields.
Affected URL, browser, account role, product area, and the state required before the behavior appears.
Endpoint, method, authentication context, and redacted request and response samples for an exact retry.
Platform, app build, device, operating system, network state, and screen-specific evidence.
Affected release range, dependency versions, installation context, minimal reproduction, and existing public references.
Build the intake workflow
Generate the structure, add your program details, test each path, and connect the triage destination.
Name in-scope products, required technical details, contact process, and pre-submission instructions.
Add real components and versions, then show API, mobile, or package questions when relevant.
Confirm required fields catch missing context without requesting unsafe or irrelevant data.
Alert a monitored security destination, then manage ownership, duplicate checks, and replies internally.
Form vs inbox vs public issue
A structured private form gives researchers a clear channel and responders consistent fields.
Field guide
Each section answers a different triage question: what is affected, how to reproduce it, what could happen, what evidence exists, and how to continue the conversation.
Researcher details
Collect a contact channel even when the researcher uses an alias. Ask separately how they want to be credited.
Affected surface
Capture the component, environment, endpoint, release, account role, device, and dependencies.
Reproduction
Separate prerequisites, numbered actions, results, frequency, and last-tested time.
Impact context
Ask about affected data, users, permissions, availability, required access, and severity rationale.
Evidence
Support text, links, screenshots, and uploads with a redaction warning beside each evidence field. Request a minimal proof.
Disclosure status
Ask whether the finding was shared elsewhere or has an existing reference. Display your response and disclosure expectations beside the form.
Related tools
Pair responsible disclosure intake with distinct forms for ordinary bugs, internal incidents, access requests, closure notes, and software changes.
Capture ordinary product defects separately from sensitive security findings.
Open toolCollect internal incident facts, affected systems, and response details.
Open toolRecord resolution, follow-up actions, and closure review after an incident.
Open toolStandardize requests for application roles and access approvals.
Open toolEvaluate proposed tools, owners, intended use, and implementation needs.
Open toolUse the historical bug-report tool for a general issue intake workflow.
Open toolFAQ
Practical answers for security teams creating a responsible-disclosure intake channel.
It is a private, structured channel for researchers to describe a suspected security weakness. It captures the affected product, reproduction, impact, evidence, disclosure status, and contact information for triage.
Include researcher contact, affected asset and version, category, summary, prerequisites, numbered steps, observed behavior, impact, redacted evidence, prior disclosure status, and preferred credit. Add product-specific API, mobile, or package fields.
No. Warn against passwords, active tokens, private keys, and unnecessary personal data beside every evidence field. Ask for redacted examples or a minimal proof.
A bug form handles ordinary failures such as crashes or incorrect output. A vulnerability form privately routes weaknesses affecting confidentiality, integrity, authorization, or availability to the security team.
Yes. Use conditional sections. Ask API reporters for endpoint and method, mobile reporters for build and device, and package reporters for release range and dependencies.
Ask for suggested severity plus impact, prerequisites, privileges, and scope. Label it as the researcher's assessment, then evaluate the evidence with your internal triage method.
Yes. Makeform is unlimited free for generating, editing, publishing, and collecting responses with the Makeform badge. The paid tier removes the badge; it does not unlock a limited trial or a larger response allowance.
Route the report to a monitored security destination, acknowledge receipt, assign an owner, check duplicates, attempt reproduction, request missing details, and follow your published response process. Keep sensitive contents out of broadly visible notifications.
Give responsible disclosure a clear front door.
