Update vulnerability_disclosure.md

update

vulnerability_disclosure.md

@@ -1,33 +1,39 @@
 # Introduction
 (Add an introduction to your organisation.)
-This vulnerability disclosure policy applies to any vulnerabilities you are considering
+This Vulnerability Disclosure Policy applies to any vulnerabilities you are considering
 reporting to us (the "Organisation"). We recommend reading this vulnerability
 disclosure policy fully before you report a vulnerability and always acting in
 compliance with it.
+
 We value those who take the time and effort to report security vulnerabilities
 according to this policy. However, we do not offer monetary rewards for vulnerability
 disclosures.
 
 # Reporting
 If you believe you have found a security vulnerability, please submit your report to us
-using the following link/email:
-[insert link/email]
-In your report please include details of:
+using the following online form OR via email:
+
+Contact: mailto:[email protected]
+Online Form: https://<<INSERT-URI>>.com
+
+In any correspondence, please include details of:
 * The website, IP or page where the vulnerability can be observed.
 * A brief description of the type of vulnerability, for example; “XSS vulnerability”.
-* Steps to reproduce. These should be a benign, non-destructive, proof of concept. This
-helps to ensure that the report can be triaged quickly and accurately. It also reduces
-the likelihood of duplicate reports, or malicious exploitation of some vulnerabilities,
-such as sub-domain takeovers.
+* Steps to reproduce. These should be a benign, non-destructive, proof of concept (no
+sensitive information. This helps to ensure that the report can be triaged quickly and
+accurately. It also reduces the likelihood of duplicate reports, or malicious exploitation
+of some vulnerabilities, such as sub-domain takeovers.
 
 # What to expect
 After you have submitted your report, we will respond to your report within 5 working
 days and aim to triage your report within 10 working days. We’ll also aim to keep you
 informed of our progress.
+
 Priority for remediation is assessed by looking at the impact, severity and exploit
 complexity. Vulnerability reports might take some time to triage or address. You are
 welcome to enquire on the status but should avoid doing so more than once every 14
 days. This allows our teams to focus on the remediation.
+
 We will notify you when the reported vulnerability is remediated, and you may be
 invited to confirm that the solution covers the vulnerability adequately.
 Once your vulnerability has been resolved, we welcome requests to disclose your report.