thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Vulnerability Disclosure Policy (VDP)

A public policy explaining how external parties can report vulnerabilities and what they can expect in return.

Definition

A VDP describes in-scope systems, reporting channels, expected researcher behavior, response timelines and legal safe harbor commitments. CISA BOD 20-01 required US federal agencies to publish VDPs. A security.txt file (RFC 9116) is a common way to advertise the contact.

Example

https://example.com/.well-known/security.txt points researchers to the VDP and a security contact email.

Exam tip

A VDP does not necessarily pay rewards, unlike a bug bounty.

Related terms