A vulnerability disclosure program (VDP) is a structured process that invites security researchers to report vulnerabilities in your systems, while a bug bounty program adds financial rewards — together, they harness the global security community to find and fix vulnerabilities before malicious actors exploit them, with Indian organisations like Razorpay, PhonePe, Zomato, and government bodies like CERT-In actively running such programs. Setting up a VDP costs little to nothing and can prevent breaches that would cost crores in damages, making it one of the highest-ROI cybersecurity investments for any Indian business with a digital presence.
Last updated October 2026
What Is the Difference Between a VDP and a Bug Bounty Program?
- Vulnerability Disclosure Program (VDP): A policy that tells security researchers how to safely report vulnerabilities to your organisation. No payment required — researchers report because it’s the right thing to do, for recognition, or for portfolio building. Every organisation should have one.
- Bug Bounty Program: A VDP with financial rewards. Researchers are paid based on the severity of vulnerabilities they discover. Attracts more participation and higher-skill researchers, but costs money. Recommended for organisations with mature security postures.
Think of a VDP as the minimum — a “see something, say something” policy for your digital assets. A bug bounty is the premium tier — paying professionals to actively hunt for weaknesses.
Why Should Indian Organisations Set Up a VDP?
- Continuous security testing: Penetration tests are point-in-time (typically annual). A VDP provides year-round coverage from thousands of perspectives.
- Cost-effective: A VDP with no bounties costs almost nothing to set up. Even bug bounties only pay for confirmed, valid vulnerabilities — you pay for results, not effort.
- Regulatory alignment: CERT-In encourages responsible disclosure. DPDP Act compliance benefits from proactive vulnerability management. RBI’s cyber security framework for banks recommends vulnerability management programs.
- Reputation protection: Better to have a researcher report a vulnerability privately than for a hacker to exploit it or a researcher to disclose it publicly because they had no way to report it.
- Talent pool: India has one of the world’s largest security research communities. Indian researchers consistently rank in the top 3 countries on platforms like HackerOne and Bugcrowd.
How to Create a Vulnerability Disclosure Policy
A VDP policy is a public document on your website that covers:
1. Scope
Define what’s in scope (which domains, applications, APIs, mobile apps) and what’s out of scope (third-party services, physical security, social engineering attacks, denial-of-service testing).
2. Rules of Engagement
- Do not access, modify, or delete other users’ data
- Do not disrupt service availability (no DDoS, no load testing without permission)
- Do not use automated scanners without explicit permission (they generate noise and can trigger incidents)
- Report vulnerabilities promptly and allow reasonable time for remediation before any public disclosure
- Do not demand payment as a condition for reporting (that’s extortion, not responsible disclosure)
3. Reporting Mechanism
Provide a clear, accessible way to report vulnerabilities:
- Dedicated email: security@yourdomain.com (with PGP key for encrypted reports)
- Bug bounty platform submission form (HackerOne, Bugcrowd)
- Web form on your security page
- security.txt file at yourdomain.com/.well-known/security.txt (RFC 9116 standard)
4. Safe Harbor Statement
This is critical — without legal protection, researchers won’t report:
“We will not pursue legal action against security researchers who discover and report vulnerabilities in good faith, following this policy. If you act in good faith and comply with this policy, we consider your research to be authorised and will not initiate legal action under the IT Act 2000 or other applicable laws.”
5. Response Commitments
- Acknowledge receipt within 3 business days
- Provide an initial assessment within 10 business days
- Keep the researcher informed of remediation progress
- Credit the researcher (with permission) when the fix is deployed
How to Set Up a Bug Bounty Program
Choosing a Platform
- HackerOne: World’s largest bug bounty platform. Used by Razorpay, Zomato, PayPal, US DoD. Managed programs start at ~$20,000/year (₹16,70,000). Self-hosted (response) programs are free.
- Bugcrowd: Second-largest platform. Strong managed services, researcher vetting, vulnerability rating. Pricing similar to HackerOne.
- Open Bug Bounty: Free platform focused on web vulnerabilities. No managed services but no cost. Good for starting out.
- Self-hosted: Run your own program via security page + email. Lower cost but requires internal expertise to triage, validate, and manage reports.
Setting Reward Structures (INR)
Typical bug bounty reward ranges for Indian organisations:
- Critical (RCE, authentication bypass, SQL injection with data access): ₹50,000–₹5,00,000
- High (stored XSS, IDOR with sensitive data, privilege escalation): ₹20,000–₹1,00,000
- Medium (reflected XSS, CSRF, information disclosure): ₹5,000–₹30,000
- Low (open redirect, verbose error messages, missing headers): ₹1,000–₹5,000
Indian companies like PhonePe offer up to ₹3,00,000 for critical vulnerabilities. Start conservative — you can always increase rewards based on report quality and volume.
Budget Planning
For an Indian company starting a bug bounty:
- Annual bounty budget: ₹5,00,000–₹25,00,000 for a medium-sized tech company
- Platform fees: ₹0 (self-hosted) to ₹16,00,000+/year (managed HackerOne/Bugcrowd)
- Internal resources: At least one security engineer to triage and validate reports (4–8 hours/week for moderate programs)
How to Manage Vulnerability Reports Effectively
- Triage promptly: Review reports within 48 hours. Nothing discourages researchers more than silence.
- Validate: Reproduce the vulnerability in a controlled environment. Assess actual exploitability and impact.
- Prioritise: Use CVSS scoring or your own risk framework. Critical and high-severity issues get immediate attention.
- Fix and verify: Development team patches the vulnerability. Security verifies the fix. Researcher confirms (if applicable).
- Reward and recognise: Pay bounties promptly (within 30 days of validation). Acknowledge researchers publicly with their permission (a hall of fame page).
- Learn and improve: Each reported vulnerability reveals something about your development practices. Feed findings into developer training and code review processes.
Frequently Asked Questions
Is it legal for security researchers to test my systems in India?
Without authorisation, testing someone’s systems may violate Section 43/66 of the IT Act 2000 (unauthorised access). A VDP policy explicitly authorises researchers to test within defined scope and rules, providing legal protection for both parties. This is why a clear safe harbor statement is essential.
What if a researcher threatens to disclose a vulnerability publicly unless I pay?
That is extortion, not responsible disclosure. Document all communications, do not pay under threat, and consult legal counsel. Report to law enforcement if necessary. A legitimate researcher will follow your disclosure timeline and work collaboratively. Most bug bounty platforms have policies against researcher blackmail and will ban offenders.
How do I handle duplicate vulnerability reports?
The first valid report of a unique vulnerability receives the bounty. Subsequent reports of the same issue are marked as duplicates with a clear explanation. Good platforms (HackerOne, Bugcrowd) handle this automatically. Be fair — if a duplicate report provides additional exploitation detail, consider a partial reward.
Should we start with a VDP or go directly to a bug bounty?
Start with a VDP. It costs nothing, establishes your reporting process, and tests your team’s ability to triage and fix issues. After running a VDP for 3–6 months and fixing the reported issues, launch a bug bounty to attract more researchers and find deeper vulnerabilities. Jumping straight to a bug bounty without internal readiness leads to frustrated researchers and overwhelmed security teams.
How do I measure the success of a vulnerability disclosure program?
Key metrics: number of valid reports received, time to triage (target: under 48 hours), time to fix (target: 30 days for critical, 90 days for medium), researcher satisfaction (response rates, repeat researchers), and reduction in vulnerabilities found during penetration tests over time. The ultimate measure is fewer security incidents in production.
The MAD helps Indian organisations establish and manage vulnerability disclosure and bug bounty programs as part of comprehensive cybersecurity services. From policy creation to ongoing program management, we build security programs that protect your business. Set up your security program.
