Vulnerability Disclosure Programs

VDPs help organizations receive vulnerability reports safely.

Program Components

- Clear policy
- Secure reporting channel
- Legal safe harbor
- Response SLAs
- Recognition/rewards

VDP vs Bug Bounty

VDP: No financial rewards
Bug Bounty: Paid rewards
VDP: Broader scope possible
Bug Bounty: Higher engagement

Platforms

- HackerOne
- Bugcrowd
- Intigriti
- Synack
- YesWeHack