Safe harbor is wording in a disclosure policy that tells researchers acting in good faith they will not face legal action for reporting an issue. It reduces the fear that stops people from writing to you. It does not replace legal advice, and it cannot bind third parties.
Why researchers look for it
Anti-hacking laws are broad, and some researchers have been threatened over honest reports. disclose.io describes safe harbor as language meant to counter the chilling effect those laws can have on good-faith research. A researcher who cannot tell whether you will treat them as an ally will often stay quiet or go public.
When two companies have similar products, the one with a clear safe harbor statement is the one that gets the early warning.
What a safe harbor clause usually covers
Most clauses say, in plain terms:
- You consider research done under the policy to be authorized.
- You will not start legal action over good-faith reports that follow the policy.
- You will say so if a third party brings a claim about that research.
- The protection applies only if the researcher stays within scope and rules.
Keep the conditions short and testable. Researchers read vague conditions as traps.
What it cannot do
A company can speak only for itself. It cannot promise that a hosting provider, a customer, a partner or a government will behave the same way. If your service runs on infrastructure you do not own, say that testing against that infrastructure is out of scope, and name what is in scope.
disclose.io itself says its content is not legal advice and that organizations should consult their own counsel. Follow that. Have a lawyer read the final wording before you publish.
How to add it without starting from scratch
disclose.io offers a policy generator, model policies and a standard terms document, and the OWASP cheat sheet points to its example policies for bounty terms. Start from one of those, trim it to your actual scope, and link it from your security page and your security.txt file using the Policy field.
Pair the clause with the rest of a working disclosure policy: scope, contact, response times and how you credit people.
Mistakes to avoid
- Burying safe harbor in a terms-of-service page nobody reads.
- Listing conditions that cannot be met, such as "never access any data".
- Promising rewards in the safe harbor text.
- Threatening legal action elsewhere on the same page. The OWASP cheat sheet advises against it.
Quick check
Does safe harbor mean researchers can test anything?
No. It covers good-faith testing inside the scope and rules you publish. Out-of-scope systems and harmful actions stay out of bounds.
Do we need a bug bounty to offer safe harbor?
No. A plain disclosure policy with no rewards can include safe harbor.
Sources
- disclose.io: overview, policymaker and safe harbor guidance
- OWASP: Vulnerability Disclosure Cheat Sheet
Last reviewed: 19 October 2026.
