Safe harbour
A statement in a vulnerability disclosure policy that the organisation won't pursue legal action against researchers acting in good faith within the policy.
Researchers are wary of reporting problems to organisations that might respond with legal threats. A safe harbour statement says that good-faith research which follows the policy's rules is authorised, and that the organisation won't take legal action over it.
The wording matters, and it can only bind the organisation making it. Have whoever handles your legal matters review it before you publish.
What a reviewer wants to see
- A safe harbour statement in the published VDP
- Clear rules on what is and isn't allowed