Vulnerability disclosure policy (VDP)
A public policy that tells security researchers how to report a vulnerability, which systems are in scope, and how the organisation will handle their report.
A VDP gives someone who finds a security problem a legitimate way to report it. It usually names a contact, lists the systems in scope and the testing that isn't allowed, says how quickly the organisation will respond, and includes a safe harbour statement.
A VDP is not a bug bounty. A bounty pays for findings; a VDP simply sets out how reports are received. Most software companies need a VDP whether or not they ever run a bounty.
What a reviewer wants to see
- A published policy and a working contact
- Scope and safe harbour stated plainly
- A route that reaches the security team, not support