Vulnerability Disclosure Policy

What is a vulnerability disclosure policy?

A vulnerability disclosure policy (VDP) is a public page that tells outside security researchers how to report a security hole (a vulnerability) they find in a vendor's product.

A typical VDP covers:

• Scope: which systems, domains or products researchers may test.
• Test methods: what is off limits. The template from CISA, the US Cybersecurity and Infrastructure Security Agency, rules out denial-of-service tests, physical testing and social engineering such as phishing.
• How to report: a web form or email address, and what details to include.
• What to expect: how fast the vendor responds. CISA's template commits to acknowledge a report within 3 business days.
• Authorization: a promise to treat good-faith research as authorized and not to pursue legal action over it.

A VDP is not a bug bounty. CISA calls the two similar but distinct: a bug bounty pays for valid findings, while a VDP can say outright that reporters will not be paid.

The standards behind it

• CISA BOD 20-01: a binding directive issued September 2, 2020. It made federal executive branch agencies publish a VDP within 180 days and bring all their internet-accessible systems into scope within 2 years. It binds agencies, not companies.
• ISO/IEC 29147: the international standard on vulnerability disclosure, whose current edition was published in October 2018. As of October 2026, ISO marks it as to be revised, with a new edition under development.
• RFC 9116 (security.txt): published in April 2022. It defines a small text file at /.well-known/security.txt on a website. The file must have a Contact field and an Expires field, and a Policy field can link to the VDP.
• CISA Secure by Design Pledge: a voluntary pledge for enterprise software makers. Signers commit to publish a VDP within one year of signing.
• EU Cyber Resilience Act: Annex I, Part II, point 5 requires manufacturers of products with digital elements to "put in place and enforce a policy on coordinated vulnerability disclosure". Its main rules apply from December 11, 2027, and its Article 14 duty to report actively exploited vulnerabilities has applied since September 11, 2026.

What it looks like in a vendor's terms

A VDP usually sits on its own page, linked from the vendor's security pages or trust center. Its key clause is the safe harbor, a promise not to treat good-faith research as a legal violation. A typical one reads like this:

If you make a good-faith effort to comply with this policy, we will treat your research as authorized, waive any restrictions in our Terms that would otherwise prohibit it, and not pursue legal action against you. We cannot grant permission on behalf of third parties.

• "Good-faith effort": the protection depends on following the policy, and the vendor usually decides whether the researcher did.
• "Waive any restrictions in our Terms": the vendor's terms of service or acceptable use policy may forbid probing the service; the VDP makes an exception for this research only.
• "Third parties": the vendor can speak only for itself, not for the cloud host or other companies behind its product.

GitHub's Bug Bounty Program Legal Safe Harbor, for example, waives restrictions in its other site policies "for the sole and limited purpose of permitting your security research."

Why it matters to you

A VDP is a signal of maturity. It shows the vendor expects outside reports and has a process to handle them. Without one, a researcher who finds a hole in a product that holds your data may not know where to report it, or may fear legal trouble for trying.

Your own customers' security questionnaires may also ask how you, and your vendors, receive vulnerability reports.

What to check

• Existence: a VDP page, and a security.txt file at the vendor's /.well-known/security.txt address.
• Freshness: the Expires date in security.txt. RFC 9116 recommends it be less than a year ahead, so an expired file suggests nobody maintains it.
• Scope: whether the product you use is in scope, not just the marketing site.
• Safe harbor: a clear promise not to pursue legal action over good-faith research.
• Response times: a committed time to acknowledge reports, such as CISA's 3 business days.
• Changes: a VDP or security contact that disappears, or a safe harbor that narrows. Ask why.

How Venpo helps

Venpo watches your vendors' public legal pages, such as terms of service, acceptable use policies, DPAs and security terms, and emails you a plain-English alert when one changes. If a vendor's legal pages narrow the security research they allow, or change the security commitments in its DPA, the alert says what changed and why it matters.

Each vendor gets a change history with a redline of each change, so you can show what a policy said before and when it changed.