Report a Vulnerability in an Irish Digital Product or Service
Last updated 6 th November 2026: Page Published
Directly reaching out to the organisation through a published security.txt file or CVD policy remains the fastest and preferred path to reporting.
The NCSC can be included in communications to maintain a national awareness.
Use the NCSC as an intermediary if:
- You wish to remain anonymous.
- You have attempted direct contact and received no response, or communication difficulties have arisen.
- Multiple organisations are involved or there is a cross border element to the vulnerability.
CVD Submission Policy and Data Processing
By submitting a vulnerability report to the NCSC, you acknowledge that you have read and agree to the following operational parameters:
1. Scope & Purpose
The NCSC acts as a neutral intermediary to facilitate the secure disclosure and remediation of vulnerabilities affecting digital infrastructure in Ireland. Reports may be triaged to verify technical validity before being shared with affected system owners.
2. Good Faith Engagement
Submissions must be made in good faith. Researchers must not use methods that exploit data privacy boundaries, involve data exfiltration or cause system disruption. The NCSC will not coordinate reports submitted under extortion criteria or pre-conditions.
3. Confidentiality & Disclosure
The NCSC will maintain all reasonable operational confidentiality during the active triage and patch window. Any public disclosure parameters must be mutually agreed upon by all parties once a fix is verified.
4. Data Processing & Recognition Notice
Personal data provided in connection with a report (such as your email address) is processed solely for the purpose of triaging, validating, and communicating regarding the vulnerability, and subject to the NCSC's obligations at law.
Where you opt to receive public credit, your provided name, handle, or team affiliation will be processed and retained for inclusion in a future NCSC Hall of Fame or public advisory acknowledgement following successful remediation. You may specify your desired credit (full name, alias/handle, or anonymous) within your report template, and you may update or withdraw your consent for public listing at any time by contacting us.
Mandatory Submission Declarations
When completing your report (via email or template), you must explicitly confirm the following:
1. Policy Consent
You must indicate in your email body that you have read and agree to the "CVD Submission Policy and Data Processing" outlined above.
2. Contact Details & Privacy:
Providing contact details is optional, however it does assist the reporting process if we are able to continue communication throughout. Your data will not be shared with third parties unless you agree to this, or we are required by law.
3. Anonymity Reminder
If you choose to submit anonymously, please ensure you take the appropriate measures. While the NCSC respects reporter anonymity, our statutory framework requires us to comply with mandatory crime reporting laws.
How to Submit Your Report
We do not use web forms to collect vulnerability data. Instead, please download or copy our standard report template and email your findings directly to our vulnerability coordination team.
Plain Text Template (.txt)
Download .txt TemplateSubmission Address: cvdreport@ncsc.gov.ie
Sensitive content should be encrypted.
To download our PGP public key, visit /PGP/cvd-pgp.asc.