Notifications
Clear all
Topic starter
20/08/2026 5:32 pm
TL;DR: A vulnerability disclosure policy can reduce missed reports, clarify scope, and create legal safe harbour, according to INTIGRITI. Its survey data shows 70% of researchers have found vulnerabilities at organisations without a VDP and 44% of those risks may remain undetected, while the governance problem is not just intake, but whether external reporting can be trusted, triaged, and closed at scale.
NHIMG editorial — based on content published by INTIGRITI: The ultimate guide to VDP: how to write a vulnerability disclosure policy
By the numbers:
- 70% of researchers say they’ve found a vulnerability for an organisation that doesn’t have a VDP.
- 44% of the risks potentially remain undetected when reports are not escalated or confirmed through the disclosure process.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: What breaks when an organisation has no vulnerability disclosure policy?
A: Reports arrive through inconsistent channels, researchers hesitate to escalate findings, and security teams lose visibility into exposures that should be remediated quickly.
Q: Why do exposed secrets in applications matter to NHI governance?
A: Because the secret is often the identity.
Q: How do security teams know if disclosure review controls are working?
A: They should look for rejection of inconsistent submissions, escalation of ambiguous cases, and independent verification of the reporting organisation before publication.
Practitioner guidance
- Define explicit in-scope identity assets List the specific assets researchers may report on, including service accounts, API keys, tokens, certificates, and exposed secrets in code or CI/CD systems.
- Build a triage path for secret exposure reports Route reports about credentials and secrets to security operations, IAM, and the application owner at the same time, with a defined owner for revocation decisions.
- Use safe harbour language with operational backing Pair the legal statement with a live contact process, response SLA, and escalation ownership so good-faith researchers know the organisation will act.
What's in the full article
INTIGRITI's full guide covers the operational detail this post intentionally leaves for the source:
- Step-by-step guidance for writing each of the six VDP components, including scope, safe harbour, and reporting methods.
- Examples of how to word disclosure commitments so researchers know what is permitted and what is not.
- Practical advice on hosting a VDP on a website versus using a bug bounty platform.
- Intake considerations for giving ethical hackers a clear path to submit valid reports without unnecessary back-and-forth.
👉 Read INTIGRITI's guide to writing a vulnerability disclosure policy →
Vulnerability disclosure policies: what security teams need to standardise?
Explore further
20/08/2026 6:19 pm
VDP is a control plane, not a compliance appendix: organisations that treat vulnerability disclosure as a static policy document miss its operational role in discovery, triage, and remediation. A disclosure process creates a governed channel for outside-in reporting, which is especially important when exposed secrets or service accounts sit outside normal monitoring. The practitioner takeaway is to manage VDP as part of security operations, not legal housekeeping.
A question worth separating out:
Q: Who should own disclosure governance when the finding involves credentials or NHI assets?
A: Ownership should sit across security operations, the asset owner, and the identity or secrets team, because revocation and containment usually span multiple functions. Legal can define safe harbour, but only operational teams can invalidate access and confirm that the exposed identity path is no longer usable.
👉 Read our full editorial: Vulnerability disclosure policies expose the governance gap in security reporting
