CRA vulnerability reporting: when does the clock start?
Cyber Resilience Act (CRA) vulnerability reporting can turn on a few hours' notice. Monday morning, 8 am. A security researcher emails your vulnerability reporting address. They have found a remote-code-execution vulnerability in one of your products. They attach working proof-of-concept [...]