A vulnerability disclosure policy, or VDP, tells outsiders how to report a security flaw and what to expect afterward. For a customer, it is a cheap signal. A clear, current policy suggests the vendor has a process. A missing one suggests it may not, and CISA lists that as a bad practice.
What a VDP is
A VDP is a public statement from a vendor covering where to send a report, what is in scope, what the vendor promises in return, and how long the process usually takes. It is separate from a security.txt file, which is a short pointer defined in RFC 9116 that tells researchers where to find contact details and, optionally, the policy itself.
Why CISA cares
CISA's product security bad practices guidance includes not having a published VDP that covers the product in its scope. The reasoning is simple. If researchers cannot find a way to report, a flaw is less likely to reach the vendor in time to be fixed quietly.
What to look for
| Element | Why it matters |
|---|---|
| A reporting contact | Without one, reports go nowhere |
| Scope, naming the products covered | A policy that skips your product does not help you |
| A statement on good faith research | Researchers need to know they will not be threatened |
| Response expectations | Shows how quickly the vendor intends to reply |
| How fixes are announced | Tells you how you will learn about them |
| A recent date or Expires value | An old policy may be forgotten |
A five minute check
- Search the vendor's site for security, disclosure or report a vulnerability.
- Try the well-known path for security.txt on their domain.
- Read the scope. Is the product you use named?
- Find where past fixes are announced.
- Note the date of the last update to the policy or to the file.
How to weigh the result
- Clear and current: A good sign. It still says nothing about how good the fixes are.
- Present but vague: Ask a follow-up question by email and see how they answer.
- Missing: Ask the vendor how reports are handled. Count a missing answer in your renewal decision.
None of this replaces testing. A strong policy on paper can sit on top of weak practice. It does show the vendor has thought about the question, which many have not.
For teams that build software
If you ship a product, a VDP is a small piece of work with outsized value. Pair it with an up-to-date inventory of your components, so that when a report arrives you can say within minutes which releases are affected.
Where Safeguard fits
Safeguard produces SBOMs and runs dependency scanning so you know what is in each release, uses reachability analysis to show whether a reported component is actually in play, and lets you set policies and gates on what ships. Free scan: gold.safeguard.sh/scan.
Quick check
Does a VDP mean the vendor will pay for bugs?
No. A VDP is about how to report and what to expect. A bounty program is separate and optional.
Can I rely on a VDP alone to judge a vendor?
No. It is one signal. Combine it with update history, support periods and how the vendor answers direct questions.
Sources
Last reviewed: 19 October 2026.
