[ 01 ] — Product — VDP
Give the internet a front door for security reports.
A managed vulnerability disclosure program lets anyone report a flaw safely — and gives you a compliant process to receive, triage and respond.
What is a vulnerability disclosure program (VDP)?
A vulnerability disclosure program is a published policy and secure channel that lets anyone report a security flaw in your systems without fear of legal action. Unlike a bug bounty, it usually offers no cash reward; its goal is a reliable, compliant way to receive reports.
[ 02 ] — Capabilities
Hosted policy page
A branded, legally reviewed disclosure policy live in minutes.
security.txt
Generated and hosted to RFC 9116.
Triage included
Noise filtered, valid reports escalated with clear severity.
Regulatory alignment
Supports CISA BOD 20-01, EU CRA and ISO 29147 obligations.
Reporter comms
Templated responses and status updates keep finders informed.
Upgrade path
Turn on rewards later without changing the intake process.
[ 03 ] — Compare
Bug bounty vs pentest vs VDP
| Bug bounty | Pentest (PTaaS) | VDP | |
|---|---|---|---|
| Coverage | Continuous | Time-boxed | Continuous, passive |
| Testers | Many invited researchers | A small vetted team | Anyone who finds an issue |
| You pay for | Valid, unique findings | The engagement | Platform and triage |
| Best for | Finding what others miss | Audit evidence and depth | A safe, compliant reporting channel |
| Methodology | Researcher-led, creative | OWASP, PTES, NIST | Not applicable |
[ 04 ] — Questions people ask
Is a VDP legally required?+
Requirements are growing. US federal agencies must have one, the EU Cyber Resilience Act requires coordinated disclosure for many products, and ISO/IEC 29147 describes good practice. Check the rules that apply to you.
What is the difference between a VDP and a bug bounty?+
A VDP is a channel to receive reports, usually without payment. A bug bounty actively incentivises researchers with rewards. Many organisations start with a VDP and add a bounty later.
What is security.txt?+
security.txt is a small file at /.well-known/security.txt that tells researchers how to report vulnerabilities to you. A VDP usually links from it.
How does AI fit with a VDP?+
A VDP collects reports from anyone. Adding AutoVAPT AI means your assets are also tested autonomously, so you are not relying only on what the public happens to report.
[ ∞ ] — Next step