PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Practical vulnerability disclosure: VDP made easy

yeswehack.com | vulnerability | #bug-bounty | #vdp | #vulnerability-disclosure | #policy | #guide | #safe-harbour
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

YesWeHack's practical guide to Vulnerability Disclosure Policies: what a VDP is, why organizations need one, its passive 'safe harbour' model versus bug bounty, and how to launch one.
Published
Collected

Related coverage

vulnerability · yeswehack.com
Showcasing your vulnerability disclosure policy to the world
A walkthrough of what makes an effective vulnerability disclosure policy — scope, safe harbour, reporting mechanism and ground rules — plus a Chrome/Firefox plugin that puts any VDP one click away.
blog · hackerone.com
Report Smarter, Not Harder: HackerOne's Case for Better CIRCIA Rules
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · hackenproof.com
Vulnerability Disclosure Policy: A Guide for Business Leaders
Explains what a vulnerability disclosure policy is and why the EU CRA and NIS2 now make it a compliance expectation, then walks through the key decisions behind each policy section, offering a free template for security and legal teams to adapt.
blog · hackenproof.com
HackenProof guide to Vulnerability Disclosure Policy
A HackenProof guide to Vulnerability Disclosure Policies: what a VDP is, why companies need one, the legal and regulatory drivers, and a recommended structure from safe harbor to reporting process.
blog · hackenproof.com
How to Create a Vulnerability Disclosure Program for Crypto Business
A guide to creating a vulnerability disclosure program for crypto businesses: why it matters, the standards from NIST and ISO to GDPR, and what a VDP should contain.
vulnerability · yeswehack.com
CVE-2023-54391 and beyond: excavating silent patches and the attacker-defender information gap
CVE-2023-54391: a Proxmox VE auth bypass fixed silently in 2023, exploited in 2026 before any advisory. The piece taxonomizes 'silent patch gaps' and why AI-assisted diffing makes them cheap to mine.
Back