The one signal

If you find a flaw in a vendor’s software, who do you tell?

It is the simplest of the nine: a published route for reporting a vulnerability. An address, a page, a security.txt file. Anything that tells a researcher — or a customer’s security team — where to send it.

15 of 124 dealership software companies publish one.

The other 109 may well handle reports properly once they arrive. We can only report what is published, and a miss is recorded as unknown, never as absent. But a route nobody can find is a route nobody uses, and the finder’s next move is usually to post it somewhere public instead.

It is also the cheapest of the nine to fix. A page and a monitored mailbox.

The full study is published: l4is.ai/study