Bug Bounty & Vulnerability Disclosure

How to receive, process and reward vulnerability reports from external security researchers in a structured way – from a vulnerability disclosure policy to a private bug bounty program.

Last updated: July 2026 · Valeri Milke, ISO 27001 & ISO 42001 Lead Auditor

Book an initial consultation Back to topic area

2complementary standards: ISO/IEC 29147 & ISO/IEC 30111

90days — the widely established CVD deadline convention

24hours to the early warning under CRA Art. 14 (from 11 September 2026)

3basic operating models: in-house, platform, managed program

External security researchers find vulnerabilities – the question is whether your organization offers them an orderly channel. A vulnerability disclosure policy (VDP), a coordinated vulnerability disclosure process and, where appropriate, a bug bounty program are the maturity stages that turn uncoordinated chance findings into a manageable process. The standards ISO/IEC 29147 and ISO/IEC 30111, together with security.txt under RFC 9116, provide the established framework. With the Cyber Resilience Act, orderly vulnerability handling also becomes a regulatory obligation for manufacturers – including a CVD policy, a reporting contact and reporting obligations that apply from September 2026.

The Essentials at a Glance

Six topic blocks — tap to expand.

A vulnerability disclosure policy (VDP) establishes a regulated reporting channel: it defines the scope, the rules of engagement and legal assurances for external reporters – without promising any reward. A bug bounty program builds on top of it and pays for valid findings in order to deliberately direct testing effort at your own systems. Public programs are open to everyone and maximize reach, but generate considerable triage effort; private programs invite selected, vetted researchers and allow tighter control of scope and quality. The proven sequence is: first a VDP and an internal handling process, then a bounty program.

Coordinated vulnerability disclosure (CVD) refers to the coordinated approach between finders, manufacturers or operators and – where necessary – a coordinator, until a vulnerability is remediated and published in a controlled manner. The process typically covers acknowledgment of receipt, triage and verification, remediation and the coordinated publication of an advisory. As a deadline convention, 90 days has become widely established; Google Project Zero, for example, works with a "90+30" model. In Germany, the BSI acts as coordinator when manufacturers do not respond or the CVD process is at risk of failing; the NIS2 Directive additionally obliges the EU Member States to adopt national CVD policies.

Two complementary standards structure the topic. ISO/IEC 29147:2018 describes the external interface: how organizations receive vulnerability reports, communicate with reporters and publish remediation information. ISO/IEC 30111:2019 governs the internal process: verifying reports, assessing impact, developing and rolling out fixes. Both editions are currently valid (most recently confirmed in 2024 and 2025 respectively) and are well suited as a reference framework for policy and process design – also with a view to the requirements of the Cyber Resilience Act.

RFC 9116 (Informational, 2022) defines security.txt, a machine-readable format that helps reporters find the right contact channel: a text file at /.well-known/security.txt, served over HTTPS. The mandatory fields are Contact and Expires; a validity of less than one year is recommended so the details stay current. Optional fields such as Policy, Encryption, Preferred-Languages and Acknowledgments point to the disclosure policy, key material or preferred languages. The file is the fastest first step towards a working VDP – provided the listed contact is actually monitored.

Bug bounty rewards are usually tied to severity, most commonly based on FIRST's Common Vulnerability Scoring System (CVSS), currently in version 4.0 (2023). Fixed amounts or ranges per severity level are common; as a rule, only the first valid report of a vulnerability is rewarded, while duplicates and out-of-scope findings are not. For operations, there are three basic models: running the program in-house (full control, but your own triage and payout effort), commercial platforms (broad reach, but more noise in triage) and managed programs with curated, identified researchers and triage handled by the provider. VamiSec, for example, runs a private, curated bug bounty program as a managed service.

The Cyber Resilience Act (Regulation (EU) 2024/2847) makes orderly vulnerability handling mandatory for manufacturers of products with digital elements. Annex I Part II requires, among other things, a software bill of materials (SBOM), the prompt remediation of vulnerabilities through free security updates, a policy on coordinated vulnerability disclosure and a contact address for vulnerability reports. From 11 September 2026, the reporting obligations under Art. 14 also apply: actively exploited vulnerabilities must be reported within 24 hours (early warning) and 72 hours (notification) to the CSIRT designated as coordinator and to ENISA via the central reporting platform, with a final report due no later than 14 days after a corrective measure becomes available. The remaining obligations essentially apply from 11 December 2027 – organizations that build their VDP and CVD process now are putting a core building block of CRA compliance in place.

VDP, bug bounty and operating models compared

From a regulated reporting channel to a managed program — the maturity stages at a glance.

Reporting channel

A vulnerability disclosure policy establishes a regulated reporting channel: it defines the scope, the rules of engagement and legal assurances for external reporters — without promising any reward.
The proven sequence: first a VDP and an internal handling process, then a bounty program.

scoperules of engagementlegal assurancesreporting channel

Standards & Sources

The content on this page is based on the following publicly available guides and studies.

ISO/IEC · 2018

ISO/IEC 29147:2018 – Information technology – Security techniques – Vulnerability disclosure

Requirements and recommendations for receiving vulnerability reports and publishing remediation information; edition 2, most recently confirmed in 2024.

ISO/IEC · 2019

ISO/IEC 30111:2019 – Information technology – Security techniques – Vulnerability handling processes

Requirements for the internal process of verifying, assessing and remediating reported vulnerabilities; edition 2, most recently confirmed in 2025.

IETF (RFC Editor) · 2022

RFC 9116: A File Format to Aid in Security Vulnerability Disclosure

Defines security.txt under /.well-known/ with the mandatory fields Contact and Expires as a machine-readable entry point for vulnerability reports.

Amtsblatt der EU / EUR-Lex · 2024

Verordnung (EU) 2024/2847 (Cyber Resilience Act)

Annex I Part II with the vulnerability handling obligations, including a CVD policy and a reporting contact; the reporting obligations under Art. 14 apply from 11 September 2026, the remaining obligations essentially from 11 December 2027.

Bundesamt für Sicherheit in der Informationstechnik (BSI) · 2022

Leitlinie des BSI zum Coordinated Vulnerability Disclosure (CVD)-Prozess

Describes how the BSI handles vulnerability reports, its role as coordinator and its expectations of reporters (version 1.0, December 2022).

ENISA · 2022

Coordinated vulnerability disclosure policies in the EU

Stocktake of national CVD policies in the EU Member States, with an outlook on the obligation introduced by NIS2 to adopt national CVD policies.

Related Services

Pentest anfragen Red Teaming — VamiRedteam IT-Security Services

Which model fits your organization?

From security.txt to a CVD policy to a private bug bounty program: in a no-obligation initial consultation, we help you determine which entry point makes sense for you.