Legal safe harbour
Explicit protection for good-faith research within scope, published as part of the program policy.
Disclosure
Vulnerability disclosure
A safe, structured way in
Give researchers a defined channel, publish the timelines you will actually meet, and handle disclosure on a record that stands up to later scrutiny.
Custom disclosure timelines are an Enterprise-tier capability; standard coordinated windows apply elsewhere.
Platform viewLive
- Evidence filesencrypted
- Malware scanclean
- Accessleast privilege
- Audit trailrecorded
Capabilities
What a disclosure program needs
Disclosure is a policy plus a process. The platform provides both, with the record to prove how each report was handled.
Disclosure timelines
Acknowledgement, triage and publication windows configured per program and visible to the reporter.
Policy templates
Mature disclosure policy structure out of the box — commitment, scope, timelines, recognition and exclusions.
CVE tracking
Request and track identifiers against the finding instead of in a separate spreadsheet.
Advisory publishing
Advisories drafted from the finding record — affected components, severity, root cause, remediation and credits.
Recognition without payment
Hall of fame entries, recognition badges and advisory credits for programs that do not pay rewards.
Coordinated disclosure
How a disclosure runs
Predictability is what keeps reports out of social media. Both sides can see the same clock.
- 01
Report received
Submission acknowledged and logged, with a policy reference for the reporter.
- 02
Triage decision
Validated, duplicate, out of scope or needs information — with the reason recorded.
- 03
Remediation communication
Progress shared on the timeline the policy commits to, without the reporter having to chase it.
- 04
Embargo and coordination
Publication date agreed according to the program’s disclosure window.
- 05
Advisory and recognition
Advisory published from the record, with credit granted where the program offers it.
Getting the policy right
A disclosure policy is short, unambiguous and published. These points cause the most confusion when they are missing.
- State the commitment: what you will do with a report and how quickly.
- Write safe harbour language clearly, and have counsel review it before publication.
- Reference the scope explicitly, including the out-of-scope list.
- Say what testers must not do — data handling, denial of service, social engineering.
- Publish the reporting channel and how to send evidence safely.
- Explain when and how findings may be discussed publicly.
- Offer recognition if you are not paying rewards, and be specific about what it is.
Documentation
Disclosure in full
Disclosure and safe harbor
Policy templates, timelines, CVE handling, advisories and recognition.
Read the docScope and rules of engagement
How scope and prohibited techniques are defined.
Read the docTriage pipeline
Where the disclosure decision is recorded.
Read the docCommon questions
Disclosure questions we hear most
Do we need a bounty program to run a VDP?
No. A VDP is the standing safe channel; a bounty adds rewards. Many organisations run a VDP first, then open a private bounty on the assets where reward-driven coverage is worth it.
What if a report falls outside the policy?
The decision and the reason are recorded on the report, so the outcome is explainable and applied consistently rather than decided case by case in someone’s inbox.
Can we control when a finding becomes public?
Yes. Coordinated disclosure windows are configured per program, and publishing an advisory is a deliberate action by the program owner.
Is safe harbour legally binding?
The platform provides the template and the workflow, not legal advice. Your counsel should review and adopt the safe harbour and disclosure clauses before they are published.
Open a disclosure channel you can stand behind.
We will help you publish scope, timelines and a safe harbour policy — then handle every report on a record that shows exactly what happened.