A Vulnerability Disclosure Program (VDP) creates a dependable channel through which external security researchers can report vulnerabilities. It explains permitted testing, contact paths and report handling. Coordinated Vulnerability Disclosure (CVD) is the subsequent collaborative process of validation, remediation and possible publication.
What does a VDP define?
A public VDP answers essential questions before testing starts: Which systems are in scope? Which methods are permitted or excluded? How can findings be transmitted securely? When can the reporter expect a response? A clearly written safe-harbor section explains how the organization treats good-faith research. It does not replace legal advice and should fit the applicable jurisdictions.
How does it differ from a bug bounty?
| Program | Purpose and compensation |
|---|---|
| VDP | A defined reporting and coordination channel; monetary rewards are not required. |
| Bug bounty program | Adds structured rewards for valid findings, often with detailed participation rules. |
| Penetration test | A commissioned assessment by selected testers within a fixed scope and period. |
An organization can start with a VDP and later add a private or public bug bounty. A VDP improves security only if incoming reports can actually be handled.
How does coordinated disclosure work?
- Receive the report, acknowledge it and offer a protected communication channel.
- Reproduce safely, assess scope and impact and identify duplicates.
- Assign responsible product and security teams and plan a realistic remediation.
- Keep the reporter informed about status and necessary questions.
- Deploy and verify the fix and investigate related products or variants.
- Coordinate publication timing and content, advisories and a CVE where appropriate.
“Coordinated” does not mean preventing publication indefinitely. Timelines should consider risk, fix availability, active exploitation and dependencies, with changes agreed transparently.
What belongs in a sound policy?
- Unambiguous scope with assets, versions and known exclusions.
- Permitted methods and restrictions on DoS, social engineering, data modification and unnecessary access.
- Rules for data minimization, evidence, confidentiality and deletion.
- Response targets for acknowledgement, triage and status updates.
- A safe-harbor statement, disclosure principles and possible recognition.
- A working contact, optional PGP, and a
security.txtfollowing RFC 9116.
How are reports handled internally?
A designated triage team verifies reachability, version, prerequisites and impact. Access to reported data is limited to those who need it. Spam, duplicates and out-of-scope submissions receive consistent responses; valid reports get an owner and deadline. Time to acknowledgement, triage, remediation and retest are useful improvement metrics-not merely the number of incoming reports.
When is external coordination needed?
When a vulnerability affects libraries, suppliers, cloud services or many vendors, several parties must act together. A CERT/CSIRT or another coordinator can establish contacts, facilitate timelines and support joint publication. For widely used products, a CVE identifier can make communication and update tracking unambiguous.
Thank you for your feedback! We will review it and optimize this content.