> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hckrt.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Vulnerability Disclosure Policy: Managed VDP on Hackrate
> Set up a Managed Vulnerability Disclosure Policy on Hackrate — give researchers a safe, structured reporting channel without requiring a bounty budget.
A **Vulnerability Disclosure Policy (VDP)** is a public commitment from your organization that you welcome responsible security research and have established a safe, structured process for receiving vulnerability reports. On Hackrate, VDP is offered as a fully managed service — the platform handles researcher intake, validation, and communication, while you focus on fixing the issues your researchers find. A VDP is often the smartest first step for organizations beginning their security testing journey, and it can run alongside a bug bounty program or PTaaS engagement.
## What a VDP is — and how it differs from bug bounty
The core distinction between a VDP and a bug bounty program is straightforward: a VDP does not require monetary rewards. Researchers who report through a VDP are contributing to the security of your organization's products because they believe in responsible disclosure — not because they expect payment.
| | VDP | Bug Bounty |
| ------------------------- | ------------------------------------------------------------------------------ | ------------------------------------------------- |
| **Monetary rewards** | Not required | Yes — defined in bounty table |
| **Researcher motivation** | Responsible disclosure, recognition | Financial reward + recognition |
| **Scope** | Typically broad; can include all public-facing assets | Scoped to specific targets with tier assignments |
| **Cost model** | Fixed platform fee (from 200 EUR/month) | Platform fee + bounty payouts |
| **Best for** | Establishing a reporting channel; compliance; first step into security testing | Continuous, reward-driven vulnerability discovery |
Many organizations run both a VDP and a bug bounty program simultaneously. The VDP provides a broad, open channel for any researcher to report any finding, while the bug bounty program focuses creative effort on specific high-priority targets with monetary incentives.
## Safe harbor and responsible disclosure
A VDP signals to the security research community that your organization will not take legal action against researchers who discover and responsibly disclose vulnerabilities within the scope and rules you define. This "safe harbor" commitment is critical — without it, researchers who find genuine vulnerabilities in your systems may choose not to report them, or may disclose them publicly without giving you time to fix them.
Your program's **Policy** field (formatted in Markdown) is where you define the terms of engagement. A strong VDP policy should include:
* What researchers are authorized to test
* What they are explicitly **not** authorized to do (for example, social engineering employees, accessing customer data, or performing denial-of-service attacks)
* How researchers should submit their reports
* What your organization commits to in response: acknowledgment timeline, investigation timeline, and fix timeline
* The safe harbor statement — your commitment not to pursue legal action for good-faith research conducted within the defined scope
The Hackrate team can help you draft a clear, legally sound VDP policy. Drawing from established frameworks such as disclose.io and NTIA's coordinated vulnerability disclosure guidelines is a good starting point.
## Setting up a managed VDP on Hackrate
From your organization dashboard, create a new program and configure it as a disclosure-only program (no monetary rewards). You can still define the scope using Targets; researchers will see which assets are in scope even without a bounty attached.
Fill in the **Policy** field with your responsible disclosure terms, safe harbor language, and testing boundaries. Use the **Description** field to introduce your organization and explain why you have established the program. Both fields support Markdown formatting.
Enable the **Embeddable Report Form** option to activate a standalone report URL and an embeddable widget that you can place on your website — for example, on a security page or within your existing developer documentation. See the section on embedding below.
Once the Hackrate team has reviewed your program, publish it. Add the VDP link to your `security.txt` file, your website footer, your developer documentation, and any other place where security researchers are likely to look.
## The embeddable report form
Hackrate provides an embeddable vulnerability report form that lets researchers submit reports directly from your own website, without needing to navigate to the Hackrate platform. This removes friction for researchers and reinforces that the reporting channel is yours — not a third-party service.
When the embeddable form is enabled for a program, you get:
**Direct link** — A standalone URL you can share in your `security.txt` file, in email signatures, or on your security page. The URL follows the pattern:
```
https://www.hckrt.com/Reports/EmbeddedReportForm?program=your-alias
```
**Embed code** — A snippet you can paste directly into your website to display the form inline. The form resizes automatically within any standard page layout.
**Allowed domains** — Optionally restrict which domains are permitted to embed the form. If no domains are configured, the form can be embedded anywhere.
### Customizing the form appearance
Two fields control how the form looks to researchers:
* **Form title** — The title displayed at the top of the form. Defaults to `[Your Program Name] x Hackrate`. You can customize this to show only your company name or a specific product name.
* **Introductory text** — Optional text shown above the form fields. Use this to explain the purpose of the form, link to your full VDP policy, or set expectations about response times. Markdown formatting is supported.
### security.txt integration
The `security.txt` standard ([RFC 9116](https://www.rfc-editor.org/info/rfc9116)) is a widely recognized convention for publishing your security contact and reporting information in a machine-readable file at `/.well-known/security.txt`. Hackrate generates a ready-to-use `security.txt` snippet from your program's embed settings. The snippet includes your policy URL, preferred languages, and canonical URL — ready to drop into your web server.
Adding a `security.txt` file is one of the highest-impact, lowest-effort things you can do to improve your responsible disclosure posture. It signals organizational maturity and makes it dramatically easier for researchers who find your assets organically to report what they find.
## Anonymous and unauthenticated reporting
Researchers who submit reports through the embeddable form can choose to provide an email address for follow-up or submit anonymously. Anonymously submitted reports are still tracked and triaged by the Hackrate team. If a researcher later creates or logs into a Hackrate account with the same email address used in an embedded submission, those reports are automatically linked to their account.
## Compliance and audit benefits
A managed VDP on Hackrate contributes directly to several compliance frameworks:
* **ISO 27001** — Supports requirements around vulnerability management (Annex A.12.6) and information security incident management
* **NIS2** — Supports the coordinated vulnerability disclosure requirements introduced by the EU NIS2 Directive
* **SOC 2** — Demonstrates a proactive approach to vulnerability identification and remediation
* **GDPR** — A VDP helps ensure personal data vulnerabilities are reported promptly, supporting breach notification obligations
Your Hackrate program provides audit-ready documentation of all reports received, their status, and your team's response — valuable evidence for any compliance review.