This page needs a newer browser to run its tools. You can still read everything here.

Web Security (OWASP Top 10:2025) Module 16

Vulnerability disclosure and CERT-In reporting interview questions

Interview questions on vulnerability disclosure and CERT-In reporting: warm-ups, then what each harder question tests and how a good answer starts.

8 questions: 2 warm-ups and 6 with model answers · Levels: Fresher to staff

Warm-up questions

Short questions with short answers, each answered in full.

Fresher to mid

What is a security.txt file, and which fields must it have?

Answered in the lesson Receiving vulnerability reports well
Fresher to mid

What does CERT-In's policy promise a reporter, and what does it not?

Answered in the lesson Reporting a vulnerability: law, scope and CERT-In

Questions with model answers

What each question tests, the first step of a good answer and the follow-ups to expect.

Fresher to senior

A researcher emails your security address at 6 pm on a Friday: any signed-in customer can read another customer's invoice by changing a number in the address. Walk through your first 48 hours: who does what, what you tell the reporter, and what you do not do.
What it tests

Running a first response: acknowledging, reproducing on a copy, rating with context, containing before fixing, and giving the reporter the next step and a date.

First step

Reply before you investigate. A short human message with a reference number, thanks and the day you will write again is the first deliverable, because the reporter cannot see your work. Then open a ticket with an owner: an invoice leak may already be in use, and the clock of your policy has started.
Follow-ups
- The access logs show someone else read invoices this way last week. What changes?
- You cannot reproduce it on staging. What do you ask the reporter for?
- The reporter asks whether they may publish after 14 days. What do you say?
From the lesson Receiving vulnerability reports well
Model answer, Pro. Model answers open with any pass; prices are in the notice on this page.
Opening the model answers with your pass…
Model answers open with any MySmartCoPilot pass.
Pro pass · 1 week₹79$2.99
30 days₹179$5.99
1 year₹1,699$45
One payment; a pass never renews. The price shown is the total you pay: no fees or charges are added at checkout.
Passes can’t be bought right now, so the model answers can’t be opened at the moment. If you have a pass, enter your licence key.
Choose a pass I have a licence key
It also opens every other in-depth part in Learn and every Pro tool. Sales are final, except where the law gives you a right to withdraw, for example in the EU and the UK (refund policy).
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
Mid to staff

A message says: pay me and I will send the details of a flaw in your site, or I post it in seven days. Your policy offers no rewards. What do you do over the next day, and what do you keep out of your reply?
What it tests

Telling research from extortion, keeping a record, involving counsel, using the policy's route, and checking your riskiest pages without waiting for the sender's details.

First step

Do not answer in the heat of the moment. Save the message with its headers, tell the people who own legal and communications, and ask for counsel before anything is sent. Then look at your own system: the claim may be false or true, and you can review your riskiest pages without the sender's details.
Follow-ups
- The sender replies with a screenshot of what looks like real customer data. Now what?
- A manager wants to pay a small amount to make it go away. How do you answer?
- How do you change the policy so that the next reporter does not need to ask?
From the lesson Receiving vulnerability reports well
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

You maintain a library on GitHub that thousands of projects depend on. A reporter privately sends a flaw in its parser. How do you coordinate the fix, the advisory and the CVE, and when do you tell the people who depend on it?
What it tests

A private fix workflow, naming affected and fixed versions, choosing the CNA route, publishing the advisory and the patched release together, and helping users who cannot upgrade.

First step

Move the conversation to a private security advisory on the repository, so the fix, the discussion and the credit stay in one place that only the maintainers and the reporter see. Work out the affected version range before you write the fix: that range is the first thing the advisory has to say.
Follow-ups
- The fix needs a breaking change. How do you ship it?
- A large user asks to hear about it early. What do you do?
- Another CNA already covers your project. Where does the ID come from?
From the lesson Receiving vulnerability reports well
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Fresher to senior

While checking your own marks on your college portal, you notice that changing the number in the address shows another student's marks. You have seen one record. What do you do next, what do you not do, and whom do you tell?
What it tests

Stopping at the first sign, noting what happened without copying data, choosing the route, and seeing why a second request changes your position.

First step

Stop. Close the page and make no further request. One response in normal use is an observation, and every request after it is a test the owner did not allow. Then write down what you did and when, in words, before you decide where to send it.
Follow-ups
- The portal has no security contact. Where do you go?
- A friend says to try a few more numbers to be sure it is real. What do you say?
- Your report gets no reply. What are the next steps and the timing?
From the lesson Reporting a vulnerability: law, scope and CERT-In
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

You found a serious flaw on a municipal service's website. It lists no security contact, and an email to its general address got no reply in three weeks. Where do you go next, what do you send, and what do you not do?
What it tests

Choosing a coordinator when the owner is silent, assembling a log and a report that stands alone, and the limits on what a reporter does alone.

First step

List what you have already done: what you sent, to whom and when. The owner has no route and has been silent, so a coordinator is the next step, here CERT-In. Then prepare one short report that stands alone, with your log, and state whether you hold any data.
Follow-ups
- The coordinator acknowledges, but the site stays vulnerable for months. What now?
- A journalist offers to publish the story. What do you do?
- You are afraid of a complaint about how you found the flaw. What do you do before you write?
From the lesson Reporting a vulnerability: law, scope and CERT-In
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to staff

While testing a company's bug-bounty programme inside its rules, you notice that a response includes other customers' phone numbers, and your browser has saved it. What do you do in the next hour, and what do you tell the programme?
What it tests

Handling data you should not hold: stopping, leaving the copy unused, telling the owner exactly what you hold, and taking legal advice before deleting or handing it over.

First step

Stop testing that path and do not open the saved file again. Note where it is stored and when it was saved. The programme's rules probably say what to do with data you meet, so read them next, before anyone is told and before anything is deleted.
Follow-ups
- The programme's rules say nothing about this. What do you ask?
- The programme asks you to delete the file and confirm. What do you do?
- You also pasted part of it into a chat with a friend. What now?
From the lesson Reporting a vulnerability: law, scope and CERT-In
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes

All Web Security (OWASP Top 10:2025) interview questions · The Web Security (OWASP Top 10:2025) track

Warm-up questions

What is a security.txt file, and which fields must it have?

What does CERT-In's policy promise a reporter, and what does it not?

Questions with model answers

A researcher emails your security address at 6 pm on a Friday: any signed-in customer can read another customer's invoice by changing a number in the address. Walk through your first 48 hours: who does what, what you tell the reporter, and what you do not do.

A message says: pay me and I will send the details of a flaw in your site, or I post it in seven days. Your policy offers no rewards. What do you do over the next day, and what do you keep out of your reply?

You maintain a library on GitHub that thousands of projects depend on. A reporter privately sends a flaw in its parser. How do you coordinate the fix, the advisory and the CVE, and when do you tell the people who depend on it?

While checking your own marks on your college portal, you notice that changing the number in the address shows another student's marks. You have seen one record. What do you do next, what do you not do, and whom do you tell?

You found a serious flaw on a municipal service's website. It lists no security contact, and an email to its general address got no reply in three weeks. Where do you go next, what do you send, and what do you not do?

While testing a company's bug-bounty programme inside its rules, you notice that a response includes other customers' phone numbers, and your browser has saved it. What do you do in the next hour, and what do you tell the programme?