writing-vdp-and-coordinated-disclosure

Draft a public vulnerability disclosure policy by defining explicit scope lists, verified submission channels, response SLAs, and a severity rubric. The policy package also includes counsel-reviewable safe-harbor language and a coordinated disclosure runbook tailored for SaaS APIs and mobile apps.

A coordinated disclosure runbook must include explicit scope lists, embargo and credit policies, response SLAs, and severity rubrics. It defines the intake process for externally shipped products like SaaS, APIs, mobile apps, or hardware, ensuring researchers have a clear reporting channel.

Generate an RFC 9116 compliant security.txt record to point researchers to your verified submission channels. This file acts as a pointer alongside your public vulnerability disclosure policy, defining scope and safe-harbor language for bug bounty adjacent programs.

You cannot create a public vulnerability disclosure policy for purely internal tools. The process explicitly refuses public-facing VDPs for internal systems and instead redirects security reporting to internal channels to prevent exposing sensitive infrastructure.

Safe harbor language in a vulnerability disclosure policy protects security researchers from legal action when they follow the defined scope and submission rules. It is designed to be counsel-reviewable, ensuring organizations provide clear legal protections for compliant bug reporting.

Define severity rubrics and SLAs within the vulnerability disclosure policy by establishing clear response timelines based on vulnerability impact. The VDP package integrates these rubrics directly with the coordinated disclosure runbook to standardize handling across SaaS, APIs, and hardware.