01VDP and bug bounty: related, but not identical
A vulnerability disclosure policy (VDP) establishes a regulated reporting channel: it defines the scope, the rules of engagement and legal assurances for external reporters – without promising any reward. A bug bounty program builds on top of it and pays for valid findings in order to deliberately direct testing effort at your own systems. Public programs are open to everyone and maximize reach, but generate considerable triage effort; private programs invite selected, vetted researchers and allow tighter control of scope and quality. The proven sequence is: first a VDP and an internal handling process, then a bounty program.
02Coordinated vulnerability disclosure as a process
Coordinated vulnerability disclosure (CVD) refers to the coordinated approach between finders, manufacturers or operators and – where necessary – a coordinator, until a vulnerability is remediated and published in a controlled manner. The process typically covers acknowledgment of receipt, triage and verification, remediation and the coordinated publication of an advisory. As a deadline convention, 90 days has become widely established; Google Project Zero, for example, works with a "90+30" model. In Germany, the BSI acts as coordinator when manufacturers do not respond or the CVD process is at risk of failing; the NIS2 Directive additionally obliges the EU Member States to adopt national CVD policies.
03The standards: ISO/IEC 29147 and ISO/IEC 30111
Two complementary standards structure the topic. ISO/IEC 29147:2018 describes the external interface: how organizations receive vulnerability reports, communicate with reporters and publish remediation information. ISO/IEC 30111:2019 governs the internal process: verifying reports, assessing impact, developing and rolling out fixes. Both editions are currently valid (most recently confirmed in 2024 and 2025 respectively) and are well suited as a reference framework for policy and process design – also with a view to the requirements of the Cyber Resilience Act.
04security.txt under RFC 9116
RFC 9116 (Informational, 2022) defines security.txt, a machine-readable format that helps reporters find the right contact channel: a text file at /.well-known/security.txt, served over HTTPS. The mandatory fields are Contact and Expires; a validity of less than one year is recommended so the details stay current. Optional fields such as Policy, Encryption, Preferred-Languages and Acknowledgments point to the disclosure policy, key material or preferred languages. The file is the fastest first step towards a working VDP – provided the listed contact is actually monitored.
05Reward and operating models
Bug bounty rewards are usually tied to severity, most commonly based on FIRST's Common Vulnerability Scoring System (CVSS), currently in version 4.0 (2023). Fixed amounts or ranges per severity level are common; as a rule, only the first valid report of a vulnerability is rewarded, while duplicates and out-of-scope findings are not. For operations, there are three basic models: running the program in-house (full control, but your own triage and payout effort), commercial platforms (broad reach, but more noise in triage) and managed programs with curated, identified researchers and triage handled by the provider. VamiSec, for example, runs a private, curated bug bounty program as a managed service.
06Cyber Resilience Act: vulnerability handling as an obligation
The Cyber Resilience Act (Regulation (EU) 2024/2847) makes orderly vulnerability handling mandatory for manufacturers of products with digital elements. Annex I Part II requires, among other things, a software bill of materials (SBOM), the prompt remediation of vulnerabilities through free security updates, a policy on coordinated vulnerability disclosure and a contact address for vulnerability reports. From 11 September 2026, the reporting obligations under Art. 14 also apply: actively exploited vulnerabilities must be reported within 24 hours (early warning) and 72 hours (notification) to the CSIRT designated as coordinator and to ENISA via the central reporting platform, with a final report due no later than 14 days after a corrective measure becomes available. The remaining obligations essentially apply from 11 December 2027 – organizations that build their VDP and CVD process now are putting a core building block of CRA compliance in place.
