A vulnerability disclosure program, or VDP, is a public policy that says how anyone can report a security flaw to you and promises good faith research will not bring legal action. A bug bounty adds money for valid reports. Most organizations should have a VDP first, and add a bounty later.
What does a VDP contain?
CISA's Binding Operational Directive 20-01 is the clearest public specification, written for US federal agencies. It requires a published policy that includes:
- which systems are in scope
- what types of testing are allowed or not allowed, with a statement prohibiting disclosure of personal data found to third parties
- how to submit a report, including where to send it, what information to include and a statement that reports may be anonymous
- a commitment not to recommend or pursue legal action against anyone whose research the agency concludes was a good faith effort to follow the policy
- expectations for when the reporter can expect acknowledgement, and a promise to be as transparent as possible about remediation
- an issuance date
The directive also says the policy must not require submission of personal information, and must not limit testing to vetted registered parties or US citizens. It suggests agencies consider stating that reporters will not be paid and waive claims to compensation, and that they may link to a separate bug bounty program that involves payment.
It also set a staged scope: at least one internet-accessible system in scope at publication, scope expanding every 90 days, and all internet-accessible systems in scope by two years after issuance. Private companies are not bound by this directive, but it works as a template.
What is different about a bug bounty?
A bounty is a program that pays for valid reports, usually with rules, a scope and a reward table. It attracts more researchers and more reports, with more noise. The decision is less about philosophy than capacity. Someone has to read every report, reproduce it, decide whether it counts, fix it and answer the reporter in a reasonable time.
How do they compare?
- Payment: a VDP pays nothing, a bounty pays for valid reports.
- Main purpose: a VDP gives a safe, clear way to report. A bounty also encourages testing and report volume.
- Volume: usually lower for a VDP and higher, with more noise, for a bounty.
- Legal safe harbor: core to a VDP, and equally needed in a bounty.
- Staff: a VDP needs triage and fixing. A bounty adds reward decisions, payment and disputes.
A constructed example
A 60 person software company gets a message on social media from a stranger who says there is an exposed admin page. Nobody knows who should read it, and the message sits for a week. The company publishes a VDP with a security email address, a scope covering its main product, and a promise not to pursue good faith researchers. It sets an internal rule to acknowledge within three business days. Two years later, with a security team that has spare capacity, it moves a narrow part of the scope into a paid program.
How to choose
Start with a VDP if you have no public reporting path. Consider a bounty if you already handle reports well, have the budget and engineering capacity to fix at speed, and have reduced the easy flaws through your own testing. Note that the standards cited here, and specialist standards such as ISO/IEC 29147, which was not fetched for this article, cover disclosure handling, and a bounty does not remove the need for your own testing.
How to check or apply this
- Create a monitored security contact address and publish it.
- Write a policy with scope, allowed testing, reporting instructions, safe harbor language and response expectations. Have counsel review it.
- Assign an owner and a service level for acknowledgement and updates.
- Track every report through to fix and keep reporters informed.
- After several months, review volume and fix times before deciding on payment.
Quick check
Does a VDP mean researchers can test anything?
No. The policy defines scope and allowed testing. Testing outside the stated scope is not authorized.
Do I need a bounty to have a VDP?
No. A VDP can be unpaid, and CISA's directive suggests stating that clearly and linking a separate bounty if one exists.
Sources
This article is general information and not legal advice.
Last reviewed: 18 October 2026.
