What Is a Vulnerability Disclosure Program?
On this page
A Vulnerability Disclosure Program (VDP) gives security researchers a safe, legal channel to report the flaws they find — and gives organizations a way to hear about problems before attackers exploit them. It is the formal answer to a basic question: when someone discovers a vulnerability in your systems, how can they tell you without fear of a lawsuit? Every organization with an internet presence should have one.
What a VDP provides#
A good VDP publishes clearly:
- Scope — what systems reports are welcome for.
- How to report — a security contact or
security.txtfile. - Safe harbor — a commitment not to pursue legal action against good-faith researchers.
- Expectations — response times and the disclosure process.
That safe-harbor promise is the heart of it: it turns responsible disclosure from a legal gamble for the researcher into a welcomed contribution.
VDP vs bug bounty#
| VDP | Bug bounty | |
|---|---|---|
| Accepts reports | Yes | Yes |
| Pays rewards | Usually no | Yes |
| Purpose | A safe channel | Actively incentivize testing |
| Maturity | The baseline duty | The next step |
A VDP is the foundation — the minimum responsible posture — and a bug bounty adds financial incentive on top. Many organizations start with a VDP and add a bounty as they mature.
VDPs are how organizations safely receive vulnerability reports. More at the Careers & Practice hub.
Frequently asked questions#
What is a vulnerability disclosure program?
A Vulnerability Disclosure Program (VDP) is a formal policy through which an organization invites and accepts reports of security vulnerabilities from outside researchers, with clear guidelines and a commitment not to pursue legal action against good-faith reporters. It is the safe, legal channel for someone to say "I found a problem" without fear.
How is a VDP different from a bug bounty?
A VDP provides a safe channel to report vulnerabilities but typically does not pay rewards — it is about accepting and acting on reports. A bug bounty adds financial incentives to actively encourage testing. Many organizations start with a VDP (a basic duty) and add a bounty later. A VDP is the foundation; a bounty is the incentive layer.