Our security address had no mailbox

We published a security contact in a dozen places and nothing was behind any of them. Nothing was broken, either — every individual step had been done correctly, into a void.

We publish a security contact address in about a dozen places: SECURITY.md, the site footer, the trust and security pages, the privacy and terms pages, our schema.org markup, and security.txt — the machine-readable file that a researcher's tooling reads before anything else.

Until the 21st of August, none of them had a mailbox behind them. Mail sent there did not bounce into some neglected support queue. The apex MX for the domain pointed at an inbound pipeline built to consume canary tripwire mail, so a vulnerability report would have been swallowed by the product it was reporting on, and we would never have known it arrived.

The outbound side was worse. Every transactional email we send — signup confirmation, password reset, canary alert, weekly briefing — carried a footer reading: this message is sent from an unattended address, replies to it are not received. The Reply-To header aimed at a no-reply address to match. A customer who hit Reply on an alert about their own security event reached nothing, and had been told in advance not to bother.

The fix is not clever. Real mailboxes: one for vulnerability disclosure, one for everything else, and a domain-wide catch-all so that no address at the domain silently discards mail. Reply-To now aims at a mailbox a person reads, and the footer says so instead of saying the opposite.

What makes this worth writing down is that nothing was broken. DNS was correct. SPF, DKIM and DMARC all passed. The address was published correctly, in the right files, in the right format, to the right standard — into a void. Every individual step had been done properly, and the path as a whole did not work, because nobody had ever walked it end to end.

There is a specific test that would have caught it and it takes two minutes: from an account outside your own infrastructure, send a message to your published security address and confirm a human receives it. Then reply from that mailbox and confirm the reply arrives with the right From line. We had run neither.

If you sell security software, your disclosure address is part of the product. Go and test yours.

This article is about a shipped surface: All product surfaces. Integration details live in the docs.