Kit vs a security@ inbox: Tracking what happens next
A security@ inbox is enough to receive a report. Kit adds an owner, a response deadline and a record of each decision, plus forms for bounty paperwork. Your team still reviews every report.
Which fits your team?
Kit fits teams that need:
- Recorded acknowledgment and resolution times
- A policy page and security.txt with expiry alerts
- A history of report ownership and decisions
- Duplicate flags and submission screening
- Bounty paperwork and exports
Email fits teams that need:
- A channel for a few reports a year
- No additional subscription
- Their existing email provider and tools
- An address they can publish as a security contact
- A simple queue with one responsible owner
- Conversations preserved in an email archive
What email does well
An existing channel, exportable messages and familiar tools.
Uses your existing email service
Create an alias on the email service you already use and assign someone to read it. Public disclosure policy templates are available from disclose.io.
In practice: A small number of reports may be manageable without another subscription.
Exportable messages
Standard email protocols and provider export tools preserve your report conversations when you change services.
In practice: You can keep the original messages, although report statuses and metrics require separate records.
A familiar contact channel
A researcher can email an address without creating an account on your portal. A disposable address works, and email can remain available if a portal is down.
In practice: You can publish the same contact address on your site, policy and security.txt.
What Kit includes
Each report gets a deadline and a reminder, so none sits unanswered while you ship. Kit brings no researchers or managed triage.
Researchers see missing payout paperwork
The report page shows whether an agreement, tax form or payout details are missing. Researchers accept the recorded agreement by clicking a button. Rejected tax forms include a reason.
Researchers can complete the missing step from their own report page.
The next action on each report
Kit highlights the current step: Assignment, Assessment, Decision or Bounty. Moving a report backward requires a comment. Idle reports trigger reminders, then an escalation to admins.
The report shows what needs doing, and its owner cannot mute the final escalation.
Triage tools for your assistant
Connect an MCP client to read reports and use guided prompts for triage, assessment, bounty approval and postmortems. Write access requires consent and the appropriate role.
Researcher replies are saved as drafts unless an admin enables direct sending. Reporter text is marked as untrusted.
Report timelines and exports
Kit records receipt, acknowledgment, assessment and resolution as dated events. Export CSVs, PDF summaries or an individual report dossier for review.
Response and resolution metrics come from recorded events. Your auditor decides whether the evidence meets their requirements.
What Kit doesn't have
Check these limits before choosing Kit.
Another vendor and subscription
Kit adds a subscription and a vendor to review. An alias on your current email service does neither. Kit holds no SOC 2 or ISO 27001 attestation today.
Will we add it? A hosted tool will always add a vendor. Kit offers monthly billing and CSV/PDF exports.
No researcher community
Neither a mailbox nor Kit recruits researchers. Your program receives what people send through the contact details you publish.
Will we add it? No. Use a researcher service if you want outside testing.
No security REST API
Email providers offer standard protocols and export tools. Kit's security queue uses MCP and webhooks, with CSV and PDF exports.
Will we add it? A security REST API is not planned.
A paid subscription
Email costs nothing extra. Kit is billed per seat once the 30-day trial ends.
Will we add it? A standalone free tier is not planned. Paid accounts have no report limit.
How each works
The difference in day-to-day use.
A structured report record
Every $8 Kit seat includes the Security workflow: intake, triage, SLAs, bounty records, and exports. Your team validates findings and handles any payouts.
A shared conversation
Email already receives reports and preserves the conversation. Your team must track ownership, severity and status, then calculate any response metrics it needs.
Plans and costs
Kit
$8/seat/month
Security workflow included in the $8/seat/month Kit subscription
- 72-hour acknowledgment clock with at-risk paging
- Response-time dashboard (time to acknowledge, time to resolve) and exports for your own SOC 2 audit
- Hosted security.txt with its expiry date kept current
- Anonymous submissions, CVSS v3.1 scoring, duplicate flagging
- Append-only bounty ledger with W-9/W-8BEN collection
A security@ inbox
No extra cost
An alias on the email service you already pay for
- Often no extra charge for an alias on an existing email plan
- No report-based limit or charge
- Free policy templates available from disclose.io
- Triage and follow-up handled by your team
- Report statuses and response metrics tracked separately
Plans and costs
Kit publishes its $8/seat/month price and includes the Security workflow. Your team handles triage and any bounty payments.
Switching from a security@ inbox?
Consider Kit for:
- Response metrics without reviewing old threads
- security.txt expiry alerts
- Likely duplicate reports shown together
- Submission screening before human review
- A record of report ownership and decisions
Stay with the inbox if you:
- Receive few reports and can track each one
- Want to avoid another subscription and vendor review
- Prefer their existing email tools
- Have a clear owner for every open thread
Data portability: Keep or export existing email through your provider. Mail archives preserve the conversation, but turning it into report statuses and metrics needs separate work. Kit exports CSVs and PDFs.
$8€6,9929,99 zł£5.99 per seat, per month
Get started free