So I was signing up for an account with <a href="https://www.enisa.europa.eu/topics/product-security/vulnerability-services/eu-incident-response-and-cyber-crisis-management/single-reporting-platform-srp">ENISA's SRP</a> (European Union Agency for Cybersecurity Single Reporting Platform) so that I can report actively exploited vulnerabilities, should they occur in any of my company's products. This is what the first page looked like. <img src="{att_link}enisa_page_1.webp" href="{att_link}enisa_page_1.webp" align="none" caption="ENISA page 1" scale="75%"> On the next page, both tabs were selected. What are they smoking? Have they ever used other apps before? <img src="{att_link}enisa_page_2.webp" href="{att_link}enisa_page_2.webp" align="none" caption="ENISA page 2" scale="75%"> Something went wrong. The app didn't feel obligated to let me know what, though. <img src="{att_link}enisa_unhelpful_error_message.webp" href="{att_link}enisa_unhelpful_error_message.webp" align="none" caption="ENISA unhelpful error message" scale="75%"> It was left up to me to guess that my session had expired---the session expires <i>very</i> quickly---by reloading the page and getting kicked back to the login. The problem was that the action could not be applied because there was no valid authentication and, therefore, no authorization to register anything. The app was incapable of telling me that. Once I'd logged back in, I was able to register. <img src="{att_link}successful_login.webp" href="{att_link}successful_login.webp" align="none" caption="successful login" scale="75%"> After having had the pleasure of filing a report<fn>---#212 baby!---I noted that this same behavior applies to their whole web site. That is, when you fill out a long form with many text fields, you can get the error message above. Thankfully, the page does not change or reload, so you don't lose your form data. The inscrutable error message is the same, though, so it's up to you to figure out that the solution is to <i>open another tab and log in again there.</i> When you've logged in again, you can come back to the form and submit it successfully, without reloading, but c'mon man, what are we doing? <hr> <ft>It turns out that we were overly cautious. ENISA quickly informed us that we really only have to report vulnerabilities in or compromises of software that we've produced and not in products that we include with our products but that are produced by third parties. TIL.</ft>