How to set up a vulnerability disclosure program (VDP)

A vulnerability disclosure program (VDP) is a public promise: if you find a security problem in our systems and report it in good faith, we will listen, respond and not take legal action against you. Setting one up is mostly about writing that promise clearly and being ready to keep it.

1. Decide the scope

List the domains, apps and APIs the policy covers, and anything excluded, such as third-party services you do not control. A narrow but honest scope is better than a broad one you cannot support.

2. Write the policy

A good policy covers what is in scope, what testing is not allowed (for example denial of service, social engineering or accessing other users' data beyond what proves the issue), how to report, what the researcher can expect from you, and a safe harbor statement. ISO/IEC 29147 and the CISA vulnerability disclosure policy template are useful references.

3. Choose a reporting channel

Use a dedicated form or platform rather than a general inbox, so reports are structured, private and tracked. Publish a security.txt file at /.well-known/security.txt that points to it, so researchers can find it quickly.

4. Set response targets

Commit to acknowledging reports within a few business days and to keeping the reporter updated. Agree internally who triages, who fixes and who approves public disclosure. Many teams use a managed triage service so reports are reproduced and scored before engineers see them.

5. Handle the first reports well

Your first few interactions set your reputation with researchers. Reply promptly, thank people even for low-severity or duplicate reports, explain decisions, and tell reporters when a fix ships. If you later want to actively attract testing, you can add rewards and turn the VDP into a bug bounty program.

This guide is general information, not legal advice. Have counsel review your policy wording, especially the safe harbor section.