Vulnerability Disclosure Program Setup for Small Companies

What a vulnerability disclosure program is

A vulnerability disclosure program, or VDP, is a public promise: if you find a security problem in our website, app or online service, here is how to tell us, here is what we will do with your report, and good-faith reporters who follow these rules will not be treated as attackers.

Small companies need one for a practical reason. Researchers, customers and automated scanners already find issues on small company sites. Without a clear contact, reports land in a general inbox, get ignored, or reach a staff member who cannot tell whether it is a scam. A VDP turns that noise into a process.

What you get

• A security.txt file following RFC 9116, served at /.well-known/security.txt on your domain, with the required Contact and Expires fields and, where useful, Policy, Preferred-Languages, Canonical and Acknowledgments. We provide the exact content; you or your web host publish it.
• A disclosure policy page in plain language: scope, testing rules, response timelines you can actually meet, and safe harbor language for your attorney to review.
• An intake channel: a dedicated address such as security@yourdomain, or a simple web form, routed to more than one person so reports are not lost when someone is away.
• A written triage process with a severity scale and a named owner for each step.
• Response templates for acknowledgment, more information needed, duplicate, out of scope, fixed, and declined.
• A short training session for the people who will read reports.

The policy: scope, safe harbor and timelines

Small company policies usually fail in three ways: scope so vague researchers do not know what they may test, timelines nobody can meet, and legal language that reads like a threat. A good policy covers:

• Scope: the specific domains and services you control. Third-party services you use, such as hosted email or payment pages, belong to their vendors and are listed as out of scope.
• Rules: no denial-of-service testing, no phishing or pretexting of your staff, no accessing or keeping more data than needed to show the problem, and stop and report immediately if personal data is exposed.
• Safe harbor: a statement that you authorize good-faith research that follows the policy and will not pursue legal action against it. Your attorney should approve the final wording.
• Timelines: how quickly you acknowledge a report and how long you ask before public disclosure.
• Recognition: whether you offer public thanks. Many small companies offer acknowledgment without payment and say so plainly.

CISA publishes a vulnerability disclosure policy template at cisa.gov. We scale that thinking to your team. The VDP setup guide walks through the basics.

Intake and triage: what happens after a report arrives

1. Acknowledge within the window your policy states, even if the reply is only "received, we are looking into it."
2. Screen: is it in scope, reproducible, a duplicate? Some messages are low-effort scanner output sent with a demand for payment. The process tells staff how to answer those politely and move on.
3. Reproduce and rate severity, so an exposed admin login gets handled before a missing header.
4. Assign and fix: name who owns the fix, whether your developer, web host or a vendor.
5. Verify and close: confirm the fix, tell the reporter, and offer credit if they want it.
6. Learn: record the root cause so it does not repeat.

VDP vs bug bounty

A VDP invites reports and promises a process. A bug bounty adds cash rewards, usually through a platform with triage staff and a budget. Bounties attract more testing, which only helps if you can absorb and fix what arrives. For most small companies, a well-run VDP comes first. A bounty can follow once triage works and the obvious issues are fixed.

Why a practicing researcher sets this up

Jacob Keith reports vulnerabilities through coordinated disclosure, including on HackerOne as @cratitoes and to the Microsoft Security Response Center (MSRC). He has been on the sending side: hunting for a contact address, waiting for a reply, reading policies to work out what is allowed. Programs that work are easy to find, answer like humans, and keep their promises. That experience shapes every policy and template.

How an engagement runs

Engagements start with a free security consult, followed by a written scope with the fee stated before any work begins. Most setups run remotely. Deliverables are text and documents you publish; you keep control of your website and accounts.

This is policy and intake setup, not a bug bounty platform or a test of your systems, and not legal advice. For an external exposure review with written authorization from the owner, see security assessments.