Prompt
Your SaaS found a fixed vulnerability that may have affected customers. The product team must decide whether to publish a standalone security advisory rather than mention it only on a status page or incident review. Give a decision framework, content plan, customer actions, and success measures.
Scenario and constraints
The vulnerability affects some versions and a fix is available, but details could help attackers. Customers span regions; some need compliance records and upgrade windows. The advisory must be verifiable and subscribable, with support, engineering, and legal aligned.
What this tests
Distinguish the user jobs of a security advisory, service incident review, and marketing update. An advisory helps customers assess exposure and remediation; an incident review explains service impact and prevention. Atlassian ties advisories to fix releases, GitHub uses advisories for affected versions and vulnerability details, and CISA stresses usable disclosure handling.
Reference approach
Classify exploitability, affected customers, required customer action, and current mitigations. If publishing, include an identifier, affected and fixed versions, timeline, detection and mitigation steps, support path, and update history. Hold exploit details until the fix and customer-notification gates pass. Keep the incident review separate for availability, detection, response, and prevention so the records do not conflict.
Critical details
Create a release responsibility matrix across security, product, engineering, support, and legal. Offer RSS or email subscriptions and machine-readable fields, with targeted notices for high-risk customers. Measure time from fix to notice, customer acknowledgement, patch adoption, false-positive rate, and update timeliness.
Common traps
Publishing only a CVSS score without customer action; stating unconfirmed impact as fact; exposing exploit details for transparency; treating an incident review as a vulnerability database; or ignoring retired versions and hosted-deployment differences.
Evaluation rubric
Strong answers explain when a standalone advisory is required and when targeted notice comes first. They define disclosure gates, a template, subscription channels, and correction mechanics while balancing security risk, customer trust, and operating cost. “Publish because transparency” alone is insufficient.
Follow-up questions
How do you respond when a customer requests full exploit details?
Verify identity, contract, and remediation status, then provide necessary detail through a controlled channel. Keep the public page actionable without increasing exploit risk, and record the disclosure decision.
What if the affected-version list is wrong after publication?
Mark the correction time and impact immediately, retain version history, and push the correction through subscriptions. Give support the same source of truth; silent edits can mislead customers.
How do you prove the advisory reduced customer risk?
Correlate readership, acknowledgements, patch adoption, and support tickets by affected version. Monitor false positives, repeat questions, and attack signals to improve the next disclosure.