Vulnerability Disclosure Programs

Create a safe channel for security researchers to report bugs.

VDPs help organizations receive vulnerability reports safely.

Program Components

- Clear policy
- Secure reporting channel
- Legal safe harbor
- Response SLAs
- Recognition/rewards

VDP: No financial rewards
Bug Bounty: Paid rewards
VDP: Broader scope possible
Bug Bounty: Higher engagement

- HackerOne
- Bugcrowd
- Intigriti
- Synack
- YesWeHack