Vulnerability Disclosure Policy

A vulnerability disclosure policy is the published statement of how an outside researcher should report a security flaw in your product, and what you commit to in return. At minimum it names a contact route that does not require a support ticket, states which systems and test methods are in scope, gives a rough timeline for acknowledgement and fix, and — the part that makes the rest work — promises not to pursue legal action against someone who follows it in good faith. Without that safe-harbour language, the rational move for a researcher is often to say nothing, which does not make the flaw go away. It is distinct from a bug bounty, which adds monetary rewards and usually a triage platform. A disclosure policy is the cheaper baseline every vendor can maintain; a bounty is an amplifier that only pays off once the easy issues are already found and there is a team able to absorb the volume. Publishing one is also increasingly expected in procurement and referenced by security frameworks. Two operational details decide whether the policy is real. The reporting address must reach someone who can act on the same day, since disclosures arriving into an unmonitored inbox are indistinguishable from having no policy at all. And there should be an agreed internal path from report to fix to notification, including whether you will publish an advisory and how affected customers are told — decisions that are much easier to make in advance than during the first serious report.