Prompt and suitable context
This is a security system-design question. The platform receives external reports, checks scope, isolates evidence, deduplicates findings, triages risk, routes ownership, verifies remediation, communicates with reporters, and publishes advisories. The engineer should turn the organization's vulnerability-disclosure policy into an executable state machine; policy, legal, and contractual boundaries are inputs for the organization to define, while the system provides evidence, permissions, and timelines.
What the interviewer evaluates
- Whether you can draw trust boundaries among researchers, the platform, product teams, vendors, and public advisories.
- Whether lifecycle, idempotency, deduplication, authorization, and audit are represented as a verifiable data flow.
- Whether you can explain tradeoffs among risk, availability, confidentiality, and remediation speed.
- Whether you treat CVSS and similar scores as inputs and combine them with exposure, exploitability, and business impact.
Clarifications to ask first
Confirm whether reporters are anonymous, registered, or invited, and whether attachments and API submissions are allowed. Clarify asset scope, safe-harbor language, prohibited testing, abuse handling, report volume, tenant isolation, regional and retention requirements, vendor or CERT coordination, severity and remediation targets, CVE/CNA ownership, and the desired disclosure policy. If scale is unspecified, state the assumptions you will use.
A 30-second answer framework
I would cover five stages: intake and isolation, normalization and deduplication, triage and routing, remediation and coordination, then disclosure and audit. A public gateway accepts only constrained formats; attachments enter quarantine and PoCs are never executed in production. A canonical report event stream with idempotency keys then supports risk-based triage and ownership. Remediation, vendor communication, and reporter updates use restricted work queues. Public advisories require approval and remediation evidence, and every action produces least-privilege audit records.
Step-by-step deep answer
1. Draw trust boundaries and protect intake
Public forms, a dedicated mailbox, and APIs enter a gateway with rate limits, CAPTCHA, content-type allowlists, and malicious-attachment scanning. Raw evidence goes to encrypted quarantine storage, while analysis is isolated from production networks. Only necessary static inspection is allowed; researcher code or requests are never replayed directly against production. Reporter personal data is encrypted separately and access is granted per case and role.
2. Use a canonical model and state machine
Each report should have a stable reportId, source, affected asset and version, evidence references, confidentiality level, severity, owner, related reports, and timeline. An idempotency key makes retries append events instead of creating duplicate work. States can include received, triage, needs-info, accepted, rejected, duplicate, mitigated, fixed, coordination, disclosed, and closed; transitions go to an append-only audit log rather than overwriting history.
3. Triage, deduplicate, and route ownership
Check scope first, then rank by affected asset, version, exploitability, exposure, data impact, and business criticality. CVSS can express severity but cannot replace environment-specific risk judgment. Fingerprints, asset versions, and evidence similarity generate deduplication candidates; an analyst confirms the relationship and preserves reporter attribution. Route to product, infrastructure, vendors, or external coordination bodies, with separated approvals and overdue escalation.
4. Remediate, coordinate with vendors, and disclose
Dispatch remediation through queues with idempotent retries and an outbox for external notifications. Every patch or mitigation links to test results and a rollback point. Case-level authorization controls reporter updates and supplemental-material requests. Disclosure timing depends on organizational policy, vendor response, and risk. GSA's public policy is an example with a two-business-day acknowledgement, up to 90 days of confidentiality, and a remediation target; it is organization-specific, not a universal legal deadline. Treat such dates as policy inputs and escalate as deadlines approach.
5. Secure, recover, and observe the system
Use KMS-managed keys and encryption in transit; enforce least privilege by case, tenant, and role, storing reporter identity separately from technical evidence. Queue consumers must be idempotent, and failed messages go to quarantine. Back up and rehearse recovery for the report database, evidence store, and audit logs independently. Monitor acknowledgement latency, triage SLA, time to remediate, aged reports, duplicate rate, missed disclosure deadlines, attachment blocks, and unauthorized-access alerts. NIST SP 800-216 treats receiving, processing, tracking, coordinating, and communicating vulnerability reports as framework elements, which is a useful completeness check.
High-quality sample answer
I would first clarify scope, safe harbor, report volume, sensitive data, vendor coordination, and disclosure policy. The public gateway accepts reports, stores raw evidence in quarantine, and keeps scanning and analysis separate from production. A normalization service creates idempotent report events and triages, deduplicates, and routes them using asset, impact, and exploitability. Remediation queues link patches, mitigations, tests, and rollback evidence; reporter communication and advisories use case-level authorization and approvals. A policy service supplies acknowledgement, escalation, and disclosure deadlines, without hard-coding one organization's 90-day example as a universal rule. Encryption, append-only audit, tenant isolation, retries, recovery drills, and overdue metrics make the workflow accountable.
Common mistakes
- Designing only an inbox, with no state machine, idempotency, or deduplication.
- Replaying a researcher PoC in production or placing attachments in the same trust domain.
- Giving every support or engineering user access to reporter identity and raw evidence.
- Ranking solely by CVSS without exposure, exploitability, or business impact.
- Treating a fixed 90 days as a universal legal deadline despite policy and vendor differences.
- Omitting remediation evidence, disclosure approval, rollback points, overdue escalation, and recovery drills.
Follow-up questions and responses
How do you accept anonymous reports while controlling spam and abuse?
Allow anonymous submission with structured fields, rate limits, duplicate fingerprints, and human triage; send risky attachments to quarantine. Anonymous submission does not bypass scope checks, and the system still records channel, time, and evidence hashes.
What if reporter identity is leaked?
Store identity separately from technical evidence, use short-lived case authorization, and audit every view. Notifications, exports, and advisory templates default to redaction; only explicitly authorized coordinators can link a real contact.
What if a vendor does not respond before the disclosure deadline?
Escalate early to the vendor owner, legal team, and an external coordination body according to policy, recording each notice and risk decision. Any extension needs an owner, reason, approval, and revised communication plan.
How do you preserve credit when two reports are duplicates?
Generate similarity candidates, then have an analyst confirm root cause, asset version, and evidence. Merge into a primary case while preserving both timelines, reporter attribution, and reward decisions instead of deleting the later report.
How do you show that the platform improves response?
Track acknowledgement latency, triage and remediation time, overdue rate, duplicate rate, erroneous disclosures, and unauthorized-access alerts by severity and asset type. Anomalies should trigger sampled review rather than a simple push for more closed cases.