Buyers ask because a published vulnerability disclosure policy (VDP) shows you have a safe, defined way to receive bug reports and a habit of dealing with them. CISA's Secure by Design pledge names a VDP and transparent vulnerability reporting as two of its seven goals. For a startup, a short page and a monitored mailbox are enough to start.
What CISA's pledge says
The Secure by Design pledge lists seven goals. Two concern this topic:
- Vulnerability disclosure policy. Signatories commit to publish a VDP that authorizes good-faith testing by the public.
- CVEs. Signatories commit to demonstrate transparency in vulnerability reporting.
The pledge is voluntary and aimed at software manufacturers. You do not need to sign it for the ideas to be useful, but it shows what large buyers and agencies now expect.
What a minimal VDP contains
- Scope. Which domains, apps and APIs are in scope, and which are not.
- Authorization. A statement that good-faith testing within the rules will not lead to legal action. Have counsel review the wording.
- Rules. No data exfiltration beyond proof, no denial of service, no social engineering of staff.
- How to report. A security email address, and optionally a form.
- What to expect. Acknowledgement within a stated time, and updates until resolution.
- Disclosure. Whether you ask reporters to wait before publishing.
Where to put it
Publish it at a stable URL from your trust page and footer. Add a machine readable pointer, such as a security.txt file, so researchers and scanners find it quickly. Many guides on this site cover the file format in depth.
CVEs for a SaaS product
CISA's goal is about transparency in reporting. For a hosted service you operate, there is often nothing for customers to install, so a CVE record may not fit every case. If a flaw affects software your customers run, such as a CLI, an agent or a library, consider publishing an advisory with a CVE. Decide your policy ahead of time and write it down, so you do not improvise during an incident.
Answer patterns
| Your state | Wording |
|---|---|
| VDP published, mailbox monitored | We publish a vulnerability disclosure policy at our security page and respond to reports within a stated time |
| Mailbox only | Reports go to our security address. We are drafting a formal policy |
| Nothing | We have no formal process yet. Planned for this quarter |
Do not mention a bug bounty unless you pay rewards. A VDP is not a bounty program.
Try it yourself
Click through it at your own pace, or open it full screen. Follow one finding from report to fix to see where a disclosure process would plug in.
Safeguard's dependency scanning and zero-day discovery help you find issues in your own stack before a researcher does. The free scan is a way to start.
Quick check
Is a VDP the same as a bug bounty?
No. A VDP says how to report and that good-faith testing is allowed. A bounty adds paid rewards.
Do we have to sign CISA's pledge?
No. It is voluntary. It is a useful reference for what buyers may expect.
Sources
- CISA, Secure by Design Pledge: VDP and CVE goals. Paraphrased.
Last reviewed: 19 October 2026.
