The Vulnerability Disclosure Policy (VDP) Ethical Charter

Why Organisations need a VDP

Driven by rapid digital transformation, organisations are deploying applications and code at an unprecedented rate, expanding their digital attack surface. While organisations invest heavily in security tools, vulnerabilities can still slip through.

A VDP acts as the digital "see something, say something" standard. It provides well-intentioned researchers with a clear "door to knock on," ensuring that when a vulnerability is discovered by chance, the organisation is alerted securely and swiftly—before malicious actors can exploit it. Today, VDPs are recognised as a fundamental cybersecurity baseline, detailed by international standards (ISO 29147 and ISO 30111) and actively mandated by government institutions globally, including the US CISA and European ENISA.

The 24-Hour Compliance Clock (EU Cyber Resilience Act): Regulatory pressure is shifting from recommendations to strict mandates. Under the European Union’s Cyber Resilience Act (CRA), manufacturers of digital products are now required to report actively exploited vulnerabilities within a gruelling 24-hour window. Without a structured, ready-to-use VDP to rapidly receive, triage, and route incoming vulnerability reports, meeting this 24-hour legal deadline is practically impossible.

The Golden Rule: VDPs vs. Bug Bounty Programs

A common source of confusion in the cybersecurity community is the difference between a VDP and a Bug Bounty program. Understanding this distinction is critical for researchers submitting reports.

Bug Bounty Programs (Proactive & Incentivised): Bug Bounty programs are highly targeted, proactive audits. Organisations invite vetted researchers to actively hunt for vulnerabilities within a strictly defined scope and timeframe. In exchange for this active labour, organisations provide financial rewards (bounties).

Vulnerability Disclosure Policies (Reactive & Non-Incentivised): A VDP is a reactive framework designed for "good Samaritan" disclosures. Researchers who submit a report through a VDP do so voluntarily, as a gesture in support of global cybersecurity. VDPs do not offer financial bounties.

The YesWeHack Philosophy: We believe in strict segregation between these two models. Blurring the lines between VDPs and Bug Bounties creates "noise" for organisations and frustration for researchers who expect a reward for a standard disclosure. By keeping them completely separate, we ensure clear expectations, ethical transparency, and a streamlined process for both security teams and the community.

Core Components of a Trustworthy VDP

When you submit a vulnerability through a VDP powered by YesWeHack, you can expect:

• Clear Guidance: Explicit rules on authorised scopes, acceptable testing methods, and required report formats.
• Legal Safe Harbour: A firm commitment that the organisation will not pursue legal action against researchers who report vulnerabilities in good faith and in compliance with the policy.
• Strict Rules of Engagement (Code of Conduct): A standard VDP clearly outlines unacceptable behaviours. To benefit from legal safe harbour, researchers must adhere to a strict code of conduct: they must not exfiltrate user data, impact production services (e.g., DDoS), or demand a ransom. They must also agree to Coordinated Vulnerability Disclosure (CVD), meaning they cannot publicly disclose the vulnerability without the organisation's explicit consent.
• End-to-End Security: Submissions are strictly confidential. Our infrastructure ensures that reports are end-to-end encrypted in the researcher's browser before being sent.
• Immutable Traceability: Every submitted report is anchored in a blockchain, guaranteeing non-repudiation and proof of deposit for the researcher.

A Message to the Hacker Community: We Respect Your Time and Safety

We know how frustrating it is to responsibly disclose a critical bug, only to hit a wall of ignored security@ emails, broken PGP keys, or worse—unjustified legal threats.

This VDP standard is built with you in mind. While VDPs are strictly non-incentivised (no financial bounties), they must still offer a flawless reporting experience. When you disclose through a YesWeHack-powered VDP, we guarantee:

• Zero Legal Friction: An ironclad Legal Safe Harbour ensures your good-faith efforts are protected.
• No Black Holes: A standardised, CVSS-based reporting form ensures your findings are properly formatted and routed directly to the security team, not lost in a generic inbox.
• Absolute Privacy: Your reports are encrypted end-to-end in your browser. You are doing organisations a favour for the common good; the least they can do is protect your identity and your data.

Secure Infrastructure You Can Trust

The infrastructure behind a VDP is just as important as the policy itself. YesWeHack provides a completely secure environment for vulnerability management:

• Zero-Knowledge Architecture: By default, YesWeHack does not have access to the contents of the vulnerability reports; they are encrypted between the researcher and the client.
• Sovereign Cloud: Our infrastructure is hosted on a European Sovereign Cloud, fully protected from extraterritorial state interference.
• Certified Security: Operations are backed by the highest industry standards, including ISO 27001, CSA STAR, SOC I / II Type 2, and PCI DSS certifications.