By Cyber Defense Technologies October 30, 2026 4 min read
Someone outside your organization may already know about a vulnerability in your website or software. They might be a security researcher, a customer or a student. Whether they tell you, and how, depends largely on whether you have made it easy and safe for them to do so.
Without a clear path, reports end up in general inboxes or social media messages, get ignored or are published without warning. A vulnerability disclosure program (VDP) fixes that.
What a VDP is
A VDP is a public policy and process that invites people to report security vulnerabilities, tells them how, and explains how the organization will respond. It typically covers what systems are in scope, what testing methods are acceptable, how to submit a report, what the reporter can expect and the organization's commitment not to pursue legal action against good-faith research.
VDP or bug bounty
- A VDP accepts reports but does not pay for them. It is the baseline every organization with an internet presence should consider.
- A bug bounty offers rewards for valid findings. It can attract more testing but brings more reports, including low-quality ones, and requires a budget, clear payment rules and more triage capacity.
Many organizations start with a VDP and add a bounty, sometimes limited to selected systems, once their triage and remediation processes are mature. A bounty is not a substitute for penetration testing, because coverage depends on what researchers choose to look at.
Write a clear policy
Scope. List the systems and applications covered, and anything explicitly excluded, such as third-party services you do not control. Start with systems you can fix and expand over time.
Rules of engagement. State what is not allowed, such as denial-of-service testing, social engineering of staff, physical intrusion, and accessing, changing or keeping data beyond what is needed to demonstrate a flaw.
Reporting. Explain how to submit a report and what to include: affected system, steps to reproduce and potential impact. Offer a secure submission method.
Disclosure. Say whether and when reporters may publish their findings, and ask for a reasonable period to fix issues first.
Safe harbor language
Researchers are more likely to report when the policy says the organization considers good-faith research within the policy to be authorized and will not recommend or pursue legal action over it. Write this language with legal counsel, keep it plain, and be clear that it covers only your organization and the systems in scope. It cannot authorize testing of systems owned by others, such as cloud providers or vendors.
Publish a security.txt file
RFC 9116 defines security.txt, a simple text file placed at /.well-known/security.txt on a website. It tells researchers where to send vulnerability reports. The Contact and Expires fields are required, and optional fields can point to the disclosure policy, an encryption key, preferred languages and an acknowledgments page. Keep the Expires date current, make sure the contact address reaches a monitored team, and consider signing the file.
Triage and respond
- Acknowledge reports quickly, even if the investigation will take longer.
- Validate and assess severity using a consistent method, and route confirmed issues to the system owner.
- Track fixes to completion with target timelines, and tell the reporter when the issue is resolved.
- Check for exploitation when a serious flaw has been exposed for some time.
- Thank reporters, and offer public acknowledgment if they want it.
Treat a program that receives reports but never fixes them as a risk, because researchers lose patience and the organization has a written record of known, unresolved flaws.
Federal agencies and BOD 20-01
CISA Binding Operational Directive 20-01 requires federal civilian executive branch agencies to develop and publish vulnerability disclosure policies and to maintain processes for handling reports, with scope expanding to cover their internet-accessible systems. Its approach, including clear scope, a commitment not to pursue legal action against good-faith reporters and a defined handling process, is a useful model for state and local governments, contractors and commercial organizations as well.
How CDT can help
CDT helps organizations find and fix vulnerabilities before others do. Our vulnerability research team can validate and assess complex reports, and our penetration testing provides structured coverage that a disclosure program alone cannot.
