Vulnerability Disclosure Policy: Managed VDP on Hackrate

Set up a Managed Vulnerability Disclosure Policy on Hackrate — give researchers a safe, structured reporting channel without requiring a bounty budget.

A Vulnerability Disclosure Policy (VDP) is a public commitment from your organization that you welcome responsible security research and have established a safe, structured process for receiving vulnerability reports. On Hackrate, VDP is offered as a fully managed service — the platform handles researcher intake, validation, and communication, while you focus on fixing the issues your researchers find. A VDP is often the smartest first step for organizations beginning their security testing journey, and it can run alongside a bug bounty program or PTaaS engagement.

What a VDP is — and how it differs from bug bounty

The core distinction between a VDP and a bug bounty program is straightforward: a VDP does not require monetary rewards. Researchers who report through a VDP are contributing to the security of your organization’s products because they believe in responsible disclosure — not because they expect payment.

	VDP	Bug Bounty
Monetary rewards	Not required	Yes — defined in bounty table
Researcher motivation	Responsible disclosure, recognition	Financial reward + recognition
Scope	Typically broad; can include all public-facing assets	Scoped to specific targets with tier assignments
Cost model	Fixed platform fee (from 200 EUR/month)	Platform fee + bounty payouts
Best for	Establishing a reporting channel; compliance; first step into security testing	Continuous, reward-driven vulnerability discovery

Many organizations run both a VDP and a bug bounty program simultaneously. The VDP provides a broad, open channel for any researcher to report any finding, while the bug bounty program focuses creative effort on specific high-priority targets with monetary incentives.

Safe harbor and responsible disclosure

A VDP signals to the security research community that your organization will not take legal action against researchers who discover and responsibly disclose vulnerabilities within the scope and rules you define. This “safe harbor” commitment is critical — without it, researchers who find genuine vulnerabilities in your systems may choose not to report them, or may disclose them publicly without giving you time to fix them.

Your program’s Policy field (formatted in Markdown) is where you define the terms of engagement. A strong VDP policy should include:

• What researchers are authorized to test
• What they are explicitly not authorized to do (for example, social engineering employees, accessing customer data, or performing denial-of-service attacks)
• How researchers should submit their reports
• What your organization commits to in response: acknowledgment timeline, investigation timeline, and fix timeline
• The safe harbor statement — your commitment not to pursue legal action for good-faith research conducted within the defined scope

The Hackrate team can help you draft a clear, legally sound VDP policy. Drawing from established frameworks such as disclose.io and NTIA’s coordinated vulnerability disclosure guidelines is a good starting point.

Setting up a managed VDP on Hackrate

1. Create a new program and select VDP

   From your organization dashboard, create a new program and configure it as a disclosure-only program (no monetary rewards). You can still define the scope using Targets; researchers will see which assets are in scope even without a bounty attached.

2. Write your policy and description

   Fill in the Policy field with your responsible disclosure terms, safe harbor language, and testing boundaries. Use the Description field to introduce your organization and explain why you have established the program. Both fields support Markdown formatting.

3. Configure the embeddable VDP form (optional)

   Enable the Embeddable Report Form option to activate a standalone report URL and an embeddable widget that you can place on your website — for example, on a security page or within your existing developer documentation. See the section on embedding below.

4. Publish and promote

   Once the Hackrate team has reviewed your program, publish it. Add the VDP link to your security.txt file, your website footer, your developer documentation, and any other place where security researchers are likely to look.

The embeddable report form

Hackrate provides an embeddable vulnerability report form that lets researchers submit reports directly from your own website, without needing to navigate to the Hackrate platform. This removes friction for researchers and reinforces that the reporting channel is yours — not a third-party service.

When the embeddable form is enabled for a program, you get:

Direct link — A standalone URL you can share in your security.txt file, in email signatures, or on your security page. The URL follows the pattern:

https://www.hckrt.com/Reports/EmbeddedReportForm?program=your-alias

Embed code — A snippet you can paste directly into your website to display the form inline. The form resizes automatically within any standard page layout.

Allowed domains — Optionally restrict which domains are permitted to embed the form. If no domains are configured, the form can be embedded anywhere.

Customizing the form appearance

Two fields control how the form looks to researchers:

• Form title — The title displayed at the top of the form. Defaults to [Your Program Name] x Hackrate. You can customize this to show only your company name or a specific product name.
• Introductory text — Optional text shown above the form fields. Use this to explain the purpose of the form, link to your full VDP policy, or set expectations about response times. Markdown formatting is supported.

security.txt integration

The security.txt standard (RFC 9116) is a widely recognized convention for publishing your security contact and reporting information in a machine-readable file at /.well-known/security.txt. Hackrate generates a ready-to-use security.txt snippet from your program’s embed settings. The snippet includes your policy URL, preferred languages, and canonical URL — ready to drop into your web server.

Adding a security.txt file is one of the highest-impact, lowest-effort things you can do to improve your responsible disclosure posture. It signals organizational maturity and makes it dramatically easier for researchers who find your assets organically to report what they find.

Anonymous and unauthenticated reporting

Researchers who submit reports through the embeddable form can choose to provide an email address for follow-up or submit anonymously. Anonymously submitted reports are still tracked and triaged by the Hackrate team. If a researcher later creates or logs into a Hackrate account with the same email address used in an embedded submission, those reports are automatically linked to their account.

Compliance and audit benefits

A managed VDP on Hackrate contributes directly to several compliance frameworks:

• ISO 27001 — Supports requirements around vulnerability management (Annex A.12.6) and information security incident management
• NIS2 — Supports the coordinated vulnerability disclosure requirements introduced by the EU NIS2 Directive
• SOC 2 — Demonstrates a proactive approach to vulnerability identification and remediation
• GDPR — A VDP helps ensure personal data vulnerabilities are reported promptly, supporting breach notification obligations

Your Hackrate program provides audit-ready documentation of all reports received, their status, and your team’s response — valuable evidence for any compliance review.