<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-vulnerability-disclosure-program
description: >-
  Design and operate a Vulnerability Disclosure Program (VDP) or Bug Bounty program to receive, triage, remediate, and acknowledge externally-reported vulnerabilities.
domain: cybersecurity
subdomain: vulnerability-management
tags:
  - vdp
  - bug-bounty
  - responsible-disclosure
  - coordinated-disclosure
  - security-txt
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
  frameworks: ["CISA VDP Directive", "ISO 29147", "ISO 30111"]
---

# Implementing Vulnerability Disclosure Program

## Overview

A VDP creates a legal, structured channel for external researchers to report vulnerabilities without fear of prosecution. Without one, researchers either sit on findings or disclose publicly. A bug bounty adds financial incentive. Both require clear scope, SLA commitments, and a triage process that respects researcher time.

Mode: `[MODE: BUILD]` — Legal review required before launch. Policy language matters.

## VDP vs Bug Bounty Comparison

| Dimension | VDP | Bug Bounty |
|---|---|---|
| Researcher incentive | Legal safe harbor, public acknowledgment | Cash rewards + safe harbor |
| Finding quality | Variable — all reporters | Higher — motivated by reward |
| Cost | Low (triage time only) | Rewards budget + platform fee |
| Volume | Lower | Higher |
| Best for | Starting out, government, regulated industries | Mature programs, broad attack surface |
| Platforms | HackerOne (free VDP), Bugcrowd, CISA template | HackerOne, Bugcrowd, Intigriti |

## Policy Required Elements

| Element | Description | Example |
|---|---|---|
| Scope | What is in/out of scope | `*.company.com` in scope; production databases out |
| Safe harbor | Legal protection for good-faith research | "We will not pursue legal action for in-scope, good-faith testing" |
| Allowed testing | What testers may do | "Automated scanning with low rate limits permitted" |
| Prohibited actions | What is explicitly forbidden | "No DoS, no data exfiltration, no social engineering" |
| Response SLA | How fast you'll acknowledge and update | Initial response: 3 days; triage: 10 days; fix: 90 days |
| Disclosure | Coordinated disclosure timeline | Researcher may publish after 90 days or fix, whichever first |
| Rewards | Whether bounties are offered and how | Optional — ranges by severity |

## Triage SLA Targets

| Severity | Acknowledgment | Triage | Remediation Target |
|---|---|---|---|
| Critical (CVSS 9+) | 24 hours | 3 days | 14 days |
| High (CVSS 7-8.9) | 48 hours | 5 days | 30 days |
| Medium (CVSS 4-6.9) | 72 hours | 10 days | 90 days |
| Low / Info | 5 days | 15 days | Best effort |

## Reward Range Reference (Bug Bounty)

| Severity | Industry Range | Factors |
|---|---|---|
| Critical RCE / auth bypass | $5,000–$50,000+ | Target sensitivity, complexity, uniqueness |
| High — privilege escalation | $2,000–$15,000 | Exploitability, access gained |
| Medium — info disclosure | $500–$3,000 | Data sensitivity, conditions |
| Low — minor issues | $100–$500 | Impact, novelty |

## Workflow

1. Draft policy with Legal — safe harbor language, scope definition, prohibited actions
2. Publish `/.well-known/security.txt` with contact, policy URL, and encryption key
3. Configure intake channel (email alias, H1/Bugcrowd, or web form)
4. Build triage queue in ticketing system with severity SLA automation
5. Assign triage rotation to security team (2-4 engineers minimum)
6. Validate each report: reproduce, confirm scope, assign CVSS
7. Route confirmed findings to responsible engineering team with fix SLA
8. Update reporter at each status change; acknowledge in Hall of Fame on fix
9. Track program metrics: MTTD, MTTR, duplicate rate, reporter retention

## security.txt Example

```
Contact: mailto:security@company.com
Encryption: https://company.com/.well-known/pgp-key.txt
Policy: https://company.com/security/vdp
Acknowledgments: https://company.com/security/thanks
Preferred-Languages: en
Expires: 2027-01-01T00:00:00.000Z
```

## Verification

- [ ] Policy reviewed by Legal before publication
- [ ] `security.txt` deployed and accessible
- [ ] Intake channel tested end-to-end (send a test report)
- [ ] Triage SLA automation configured in ticketing system
- [ ] Safe harbor language explicitly covers good-faith testing
- [ ] Disclosure timeline and researcher communication process documented

## Related Techniques

- [Performing Red Team Vulnerability Validation](../performing-red-team-vulnerability-validation/SKILL.md)
- [Prioritizing Vulnerability Remediation](../implementing-vulnerability-prioritization/SKILL.md)
