How to create a Vulnerability Disclosure Program step by step

By Kike Gandia · Co-Founder & CEO, OSCP

A Vulnerability Disclosure Program (VDP) is the official channel through which security researchers can report vulnerabilities in your systems in a coordinated, responsible way. Implementing one properly takes more than publishing a contact email: you need a clear policy, a response process and the resources to run it.

1. Define the VDP's scope

The scope determines which systems, applications and domains are included in the program. A well-defined scope protects both the company (avoids reports about systems outside your control) and the researchers (they know exactly what they can and can't test).

Scope elements:
• In-scope systems: URLs, domains, applications, APIs included.
• Out-of-scope systems: third-party infrastructure, services you don't control, partner subdomains.
• Accepted vulnerability types: which kinds of findings are welcome.
• Prohibited testing: DoS, social engineering, physical access, etc.

2. Write the responsible disclosure policy

The policy is the implicit contract between your company and researchers. It should include:

Your company's commitment: maximum time to first response, target resolution time, whether there will be public recognition.
The researcher's rules: no accessing third-party data, no disrupting service, no disclosing before resolution.
The coordinated disclosure process: how it's handled if the researcher wants to publish the finding.
The recognition process: Hall of Fame, public mention, swag (if there's no monetary bounty).

The reference standard is ISO 29147 (coordinated vulnerability disclosure).

3. Implement the intake channel

The channel must be accessible, secure and reliable. The most common options:

A dedicated email: security@yourcompany.com with optional PGP encryption.
A secured web form: more structured, makes triage easier.
A specialized platform: HackerOne Response, Bugcrowd, Intigriti (free or low-cost VDP tiers).

Publish the channel in:
• The security.txt file at /.well-known/security.txt (RFC 9116 standard).
• Your website's security page.
• Your privacy policy or terms of use.

Making it visible is essential: if researchers don't know how to report, they'll post it directly on Twitter.

4. Design the triage and response process

Receiving the report is only the first step. You need a process to:

Acknowledge receipt within 24-48 hours.
Technically validate the vulnerability.
Communicate the assessment to the researcher (valid / false positive / out of scope / duplicate).
Assign remediation to the relevant technical team.
Confirm to the researcher once the vulnerability has been patched.

If you don't have a team to do this, an outsourced triage service is the most efficient solution.

5. Publish and communicate the VDP

A VDP nobody knows about is useless. Once launched:

Publish the announcement on your security blog or company page.
Communicate it on channels where researchers are active: LinkedIn, Twitter/X, bug bounty platforms.
Register it in public VDP directories (such as ENISA's or Bugcrowd's).
Consider a private launch first: invite a select group of researchers before going public to validate the process.

FAQ

Is a VDP the same as a bug bounty?

No. A VDP is a responsible disclosure channel that doesn't offer monetary rewards, though it can include public recognition. A bug bounty does include monetary payments for valid vulnerabilities. Many companies start with a VDP and evolve into a bug bounty once the program is mature.

Does NIS2 require having a VDP?

NIS2 requires essential and important entities to have mechanisms in place to manage and report vulnerabilities. A VDP is the most widespread implementation for meeting this requirement. The Cyber Resilience Act also requires vulnerability notification channels for manufacturers of products with digital elements.

How long does it take to implement a VDP from scratch?

With dedicated internal resources, a basic VDP can be operational in 2-4 weeks. If the design and implementation are outsourced to a specialized provider, the timeline can shrink to 1-2 weeks for the basic channel, with report management operational from day one.

Sources

Request help implementing my VDP