Bugcrowd Vulnerability Disclosure Program (VDP)

Bugcrowd Vulnerability Disclosure Program (VDP) is a platform that enables organizations to establish and manage vulnerability disclosure programs. The platform provides a structured channel for security researchers to report security vulnerabilities in an organization's assets under responsible disclosure terms. The service includes managed triage capabilities where an in-house team validates, triages, and prioritizes vulnerability submissions. The platform integrates with development and security tools to facilitate remediation workflows. Organizations receive multiple submission methods for researchers to report vulnerabilities, along with analytics and reporting capabilities. The platform operates on Bugcrowd's security knowledge graph containing data from thousands of customer engagements. This data informs workflows, AI models like CrowdMatch, and provides contextual remediation advice. The service includes CVE numbering authority capabilities, allowing organizations to request official CVE IDs for discovered vulnerabilities. The platform supports compliance requirements including BOD 20-01, HIPAA, SOX, GLBA, PSTI, DORA, NIS2, and CRA. Organizations can use VDP to establish safe harbor policies for security researchers and build relationships with the security community for future collaboration. The service provides dashboards for monitoring key performance indicators and tracking vulnerability trends. Multiple service plans are available including self-service options.