What is a Vulnerability Disclosure Programme (VDP)?
By Kike Gandia · Co-Founder & CEO, OSCP
A Vulnerability Disclosure Programme (VDP) is the formal mechanism through which an organisation establishes how external security researchers can report vulnerabilities they find in its systems, applications or infrastructure. It defines the rules, the communication channel, response times and the resolution process.
Why companies need a VDP
Without a VDP, researchers who find vulnerabilities in your systems have three options: ignore it, publish it directly (full disclosure) or try to contact you through unofficial channels. None of these options is good for you.
With a VDP, you offer a clear, safe channel for anyone who wants to help you to do so. The result is that vulnerabilities reach you before they reach attackers.
Components of a well-designed VDP
An effective VDP includes:
- Disclosure policy: the programme rules, scope, what is and is not permitted, and the safe harbour process for the researcher.
- Reporting channel: where and how to submit the report (form, email, platform).
- Response commitments: maximum times for first response and resolution.
- Acknowledgment process: Hall of Fame, public mention, or simply a thank-you.
- Coordinated disclosure process: what happens when the researcher wants to publish the finding.
VDP and regulatory compliance: NIS2 and the CRA
Two European regulations make a VDP no longer optional for many companies:
NIS2 (Network and Information Security Directive 2): requires essential and important entities to have mechanisms for managing vulnerabilities and notification channels. Companies operating in sectors such as energy, transport, health, finance, digital infrastructure or digital services must comply.
Cyber Resilience Act (CRA): requires manufacturers of products with digital elements to have channels for receiving and managing vulnerability reports, and processes for reporting actively exploited vulnerabilities to the authorities.
Difference between a private VDP and a public VDP
Private VDP: only invited researchers can participate. Lower report volume, greater control over participants. Ideal for new programmes that are validating the response process.
Public VDP: any researcher can report. Higher report volume, more diverse findings. Requires a more robust triage process and stricter response times to maintain the programme's reputation.
FAQ
What is the difference between a VDP and a bug bounty?
A VDP does not offer monetary rewards; a bug bounty does. A VDP is a responsible disclosure channel with non-monetary recognition. A bug bounty adds payments proportional to the severity of findings. Many companies start with a VDP and evolve to a bug bounty once the programme is mature.
Where should I publish my VDP?
In the security.txt file at /.well-known/security.txt (RFC 9116 standard), on a dedicated page on your website (security.yourcompany.com or yourcompany.com/security), and in the footer or privacy policy. The more visible it is, the easier it is for researchers to find it.
Do I need a platform to have a VDP?
No. You can have a VDP with a dedicated email address and a policy published on your website. Platforms like HackerOne Response, Bugcrowd or Intigriti offer free or low-cost VDPs with integrated management tools, but they are not required to get started.