Vulnerability Disclosure Policy

A Vulnerability Disclosure Policy (VDP) defines how a software manufacturer will receive, respond to, and credit reports of security defects from external researchers.

A VDP signals to the security research community that the manufacturer is open to receiving vulnerability reports in good faith. Without a VDP, researchers often have no safe channel to report issues — and the manufacturer never learns of the defect, or learns of it only when it becomes public.

A VDP should be a baseline expectation for any software manufacturer.

Discussion prompts

• Does your organization have a published VDP? Is it easy for researchers to find? (security.txt)
• How does your team respond when a defect is reported externally? What do external reporters think of your VDP?
• What barriers exist that might prevent a researcher from reporting a defect to you?