VULNERABILITY DISCLOSURE PROGRAM
A safe way for researchers to report your bugs
We set up and run your Vulnerability Disclosure Program, from policy to fix.
What is a Vulnerability Disclosure Program (VDP)?
A Vulnerability Disclosure Program (VDP) is a public policy and process that lets outside security researchers report vulnerabilities to you safely and legally. It defines scope, how to report, how reports are handled and safe-harbour terms, with triage and fix tracking aligned to ISO/IEC 29147 and 30111.
Researchers will find bugs. Make it easy to tell you.
Without a VDP, reports get lost or go public. With one, you fix issues first.
What we cover
Disclosure policy and safe harbour
security.txt and reporting page
Report intake and validation
Severity rating and triage
Fix tracking and researcher replies
How it works
Design
Scope and policy.
Publish
Policy page and security.txt.
Receive
Intake and acknowledge.
Triage
Validate and rate.
Resolve
Track fixes and close.
What you get
Who needs it?
SaaS and internet-facing companies
Banks and fintechs
Companies receiving unsolicited bug reports
Teams preparing for a bug bounty
Why HostX
Expert triage
Validated by our pentesters.
Less noise
Duplicates and invalid reports filtered.
Standards-aligned
ISO 29147 and 30111.
Related services
Frequently asked questions