A vulnerability disclosure program (VDP) is a published way for anyone to report a security issue to you, with rules for how you will respond. A bug bounty is a program that pays rewards for valid findings. Most organizations start with a VDP because it is the foundation, and add a bounty later if they want paid research.
Key takeaways
- A VDP gives reporters a channel, scope, safe harbor and expectations. It may or may not pay.
- A bug bounty pays per valid vulnerability, usually within a defined scope and reward tiers.
- A VDP can cover more assets than a bounty, because it does not need a price list.
- CISA's directive BOD 20-01 shows what a baseline VDP must contain for US federal agencies.
- Many organizations run both, with the VDP as the base layer.
Safeguard publishes this guide and does not sell a bounty platform. We describe the programs from the CISA directive and from one platform vendor's own blog, so treat the vendor's framing as that vendor's view.
What is a vulnerability disclosure program?
A VDP is a structured method for third parties to report vulnerabilities. A platform vendor's guide defines it as a structured method for third parties, researchers and ethical hackers to report vulnerabilities easily. CISA's directive BOD 20-01 requires US federal agencies to publish one, and lists the contents below.
- Scope: at least one internet-accessible production system or service in scope at publication.
- Testing: the types allowed or not authorized, and a statement that discovered personal information must not be disclosed to third parties.
- Reporting mechanism: where to send reports, what information to include, and a clear statement that reporters may submit anonymously.
- Legal safe harbor: a commitment not to recommend or pursue legal action against good-faith research the agency deems authorized.
- Expectations: when reporters can expect acknowledgment, and a commitment to be transparent about remediation.
- An issuance date.
Our guide to writing a VDP covers each clause.
What is a bug bounty program?
A bug bounty is a reward that organizations offer to ethical hackers for discovering bugs. The same vendor's guide says the key difference from a VDP is that bounties pay cash for each vulnerability discovered, usually against defined assets, with reward tiers and response times.
A bounty needs triage capacity, because payouts create more reports and more disputes about severity and duplicates.
What are the main differences?
Payment and scope are the two big ones. This table summarizes the criteria from the sources.
| Criterion | VDP | Bug bounty |
|---|---|---|
| Purpose | Give researchers a safe, clear way to report | Reward researchers for valid findings |
| Payment | Not required, may offer recognition | Cash per valid vulnerability |
| Scope | Can be broad, since no price list is needed | Usually defined assets with reward tiers |
| Audience | Anyone | Public or private, can be switched on and off |
| Team load | Triage and response | Triage, severity disputes, payouts |
| Starting point | The base layer | Often added after a VDP |
Which should you start with?
Start with a VDP. A VDP is the lowest-cost way to be reachable, and it makes safe harbor and expectations explicit before money is involved. The vendor's guide says organizations starting with a VDP want to start small and receive reports from third parties, and that many combine the two later.
Add a bounty when you have a working triage process, fix capacity, and a reason to pull in researcher attention, such as a major product launch. A bounty without a team to answer reports will produce unhappy researchers.
Do you need either one?
If you run internet-facing software, someone will find an issue eventually, and having a channel means they have somewhere to send it. We found no primary-source rule that makes this universal for private companies. Customers, regulators and contracts may ask, so check what yours say.
A very small first step is a security.txt file that points to a contact address. See security.txt: what it is.
How to choose
- Do you have someone who reads and answers security reports within a few business days? If not, fix that first.
- Do you want a public channel and safe harbor language? Publish a VDP.
- Do you want to pay for research and can triage volume? Add a bounty.
- Is your scope broad or hard to price? Prefer a VDP.
- Do you need a private program for a launch? Many platforms offer private bounties.
Frequently asked questions
Is a VDP the same as responsible disclosure?
Related but not identical. A VDP is the published policy and channel. Responsible or coordinated disclosure describes how reporter and vendor handle timing. See coordinated vulnerability disclosure.
Can a VDP pay rewards?
It can. The vendor's guide says some VDPs reward researchers without paying per vulnerability, and others add payment later, at which point it becomes a bounty.
Do I need a platform to run either?
No. You can run a VDP with a mailbox and a policy page. Platforms add triage tooling, researcher reach and payments. See bug bounty platform or own intake.
What does CISA say about response times?
BOD 20-01 recommends acknowledgment within 3 business days, initial assessment within 7 days, and resolution within 90 days. These are recommendations, not mandatory deadlines.
Will a bounty replace penetration testing?
Not by default. Bounties are open-ended and unscheduled, while a pen test has a defined scope and report. Many teams use both.
Sources
- CISA, BOD 20-01, Develop and Publish a Vulnerability Disclosure Policy
- Platform vendor blog, Bug Bounty vs. VDP, published 4 November 2021
- Platform vendor blog, Vulnerability Disclosure Policy Basics, published 10 August 2017
Last reviewed: 19 October 2026.
