The Heartbleed bug became public on Tuesday. By Thursday afternoon, we were editing Shutterstock’s customer update line by line.
The technical response had moved quickly. We applied the OpenSSL patches to public-facing systems, reissued security keys, and took additional steps on internal servers. Production was patched by the time the public post was ready.
The writing still mattered.
One draft sentence recommended that customers change passwords on sites where they shared personal information, including Shutterstock. Read one way, that sounded like we knew of a breach and were telling people to react to it. That was not the situation we were trying to communicate.
I agreed that the sentence should become a proactive security recommendation rather than a request that everyone immediately change a password because of Shutterstock.
This is one of the hardest parts of incident communication. Customers need useful information, and they need it quickly. The company also has to separate what it knows from what it fears, what it fixed from what it is still checking, and general security advice from a specific instruction.
Too soft, and the message sounds evasive. Too dramatic, and it can create a second incident made of confusion.
The draft explained the vulnerability in plain language. OpenSSL helped provide the encrypted connection represented by the padlock in a browser. Researchers disclosed a flaw that affected many sites. We learned about it with the rest of the public, moved to patch affected systems, and renewed the relevant keys.
The final update went onto the Shutterstock blog that afternoon under my name and title. The original URL from the internal thread is no longer a reliable archive, so I am not treating its continued availability as evidence here. The email record preserves the draft, the review, and the decision to publish.
Heartbleed was an internet-wide event, but every company still had to respond in its own systems and its own voice. Our job was to fix the software, verify the state, and give customers a message that was direct without claiming either a disaster or perfect certainty.