Security Notes

Analyses on product security.

Technical analyses, practical engineering insights and regulatory context for teams developing security-critical products.

Redlings’ own investigations and research findings are published under Research.

All Engineering Current Field Notes
Current Note Aug 27, 2026 7 min read

CRA Vulnerability Reporting: The Technical Reality of the 24-Hour Window

From 11 September 2026, actively exploited vulnerabilities must be reported under the CRA: early warning in 24 hours, notification in 72. The legal side is documented, this is the engineering side: what the window demands from triage, SBOMs and telemetry.

RegulationVulnerability
Current Note Aug 13, 2026 6 min read

EN 18031 and the CRA: What Security Testing Can Show, and What It Can’t

EN 18031 is harmonized under the RED, not the CRA. No CRA harmonized standard exists yet. What testing against EN 18031 actually establishes, how evidence maps to CRA Annex I, and why declarations and pentest findings are not interchangeable.

RegulationTesting