Disclosure policy page
Scope, allowed testing, how to report, what researchers can expect, and a 90-day coordinated disclosure window.
The Problem
Security Bugs Get Reported Somewhere, Just Not Where You Would See Them
It shows up the day a researcher finds a flaw in your app, can't find anyone to tell, and decides how long to wait before telling everyone else.
01 · Contact
Researchers can't find anyone at your company to tell.
A security.txt file and a policy page name one reporting address.
02 · Intake
Reports land in your sales or support inbox.
Reports go to a tracked security queue with an automatic acknowledgment.
03 · Triage
Your team can't tell whether a report is real or urgent.
A triage checklist and a named triager judge severity within your response targets.
04 · Disclosure
Researchers go public because nobody replied.
Your policy sets a disclosure window, and templates keep each reporter updated.
A researcher finds that your password reset page leaks customer email addresses. They search your site for a security contact and find only the sales chat. Their email to support gets an auto-reply and a ticket about billing. Weeks later they post the details publicly and tag your company. Your engineers patch it in a hurry while sales answers worried customers. The fix took an afternoon. The silence cost far more.
We start by deciding what you want reported and how you'll answer. We write a disclosure policy with scope, testing rules, a safe harbor draft for your counsel, and a disclosure window. Then we publish a signed security.txt file, route reports to one intake your team watches, and set a triage routine with reply templates. Researchers get a clear path and a reply, instead of a reason to go public.
A file researchers check first
Published at /.well-known/security.txt with a contact, an expiry date, and a link to your policy.
One intake your team watches
Every report lands in a tracked queue with an automatic acknowledgment, not a shared support inbox.
Clear rules and safe harbor
Scope, allowed testing, and good-faith protections written down, with a draft for your counsel to review.
Our Vulnerability Disclosure Program Setup Process
From Disclosure Call to a Live Reporting Channel in Five Clear Steps
You approve the scope, testing rules, and response targets before anything goes public, then watch a test report travel through the workflow.
We look at what you ship, who answers security email today, and any reports you've already had. You get a written scope and a fixed price. If a simple security.txt file and your existing support desk cover your case, we'll tell you before we quote.
What's Included
What You Get With a Vulnerability Disclosure Policy and Intake
Each setup covers the policy and a safe harbor draft, a signed security.txt file, a reporting channel with acknowledgments, a triage checklist, reply templates, and a dry run.
Compare Options
DeveloperLook vs a Bounty Platform vs a Shared Inbox
A bug bounty platform brings a crowd of researchers and pays them per finding, and a shared inbox costs nothing to set up. Here is how a program built around your own team compares.
| Feature | DeveloperLookBest fit | Bounty platform | Shared inbox |
|---|---|---|---|
| Planning | Scope and rules agreed with you | Platform onboarding | No planning step |
| Policy | Written for your products | Platform template | No published policy |
| Researcher reach | Anyone who finds a flaw | Large invited crowd | Whoever finds the address |
| Intake | Tracked queue with acknowledgments | Platform dashboard | Mixed with support email |
| Triage | Your team, with our checklist | Platform triage team | Whoever opens it |
| Rewards | Credit, no payments required | Cash per valid finding | Nothing offered |
| Ownership | Policy and workflow you own | Tied to the platform | Nothing documented |
| Cost | Fixed price from $650 | Platform fees plus bounties | Free to set up |
DeveloperLook
Bounty platform
- Planning
- DeveloperLook: Scope and rules agreed with youBounty platform: Platform onboarding
- Policy
- DeveloperLook: Written for your productsBounty platform: Platform template
- Researcher reach
- DeveloperLook: Anyone who finds a flawBounty platform: Large invited crowd
- Intake
- DeveloperLook: Tracked queue with acknowledgmentsBounty platform: Platform dashboard
- Triage
- DeveloperLook: Your team, with our checklistBounty platform: Platform triage team
- Rewards
- DeveloperLook: Credit, no payments requiredBounty platform: Cash per valid finding
- Ownership
- DeveloperLook: Policy and workflow you ownBounty platform: Tied to the platform
- Cost
- DeveloperLook: Fixed price from $650Bounty platform: Platform fees plus bounties
Projects We've Built
SaaS, Marketplace, and App Products We Have Built
Products we built for teams with public apps and sign-ups, the kind of software outside researchers probe. Products like these need a clear way to receive reports.
PixelVault NFT Marketplace Web Design & Development
- Crypto & NFT
- Dashboard
- Website
Saasmo Recruiting Software Web Design & Development
- Technology
- HR & Staffing
- SaaS Platform
CognifyHR AI Recruitment Website and HR Dashboard
- HR & Staffing
- Technology
- Dashboard
Petopia Pet Care App Design & Development
- Pets
- Booking System
- Mobile App
What Our Clients Say
What Clients Say After Launch
Feedback from teams we have built apps, platforms, and websites for.
We had a pretty specific idea of what we wanted our website to become, but I wasn’t sure how easily we could explain all of it to a development team. There were quite a few moving parts, and we were working toward a deadline, so I expected a few things to get lost along the way. That never really happened. They understood what we were trying to achieve, kept us updated throughout the process, and got everything ready within the agreed timeline. The final site feels much easier to navigate, works beautifully on mobile, and is noticeably smoother for our customers. It was a huge relief seeing the original idea actually turn into the website we had in mind.
The mobile experience is probably my favourite part of the new site. We had spent a lot of time making sure the desktop version looked right, and the team kept pushing us to think about how everything would actually feel on a phone too. They were right. The navigation is clean, the interactions feel natural, and everything we’ve tested so far works exactly as it should. They also went through the links, forms, integrations, and other details more than once before launch, which I really appreciated. And even after going live, we could still reach out when something came up. The whole process felt friendly, organised, and surprisingly straightforward.
What I appreciate most is that the website is actually easy for us to manage now. We can update content ourselves instead of sending a developer a message every time we need to change something small. They also paid attention to the technical SEO side, which mattered to us because we didn’t want a new website to create problems for the traffic we already had. I’ve probably asked more questions than I should have since launch, but every question has been handled patiently and without any fuss. The team is easy to work with, they explain things clearly, and when we need something changed, they focus on getting it done rather than making the process complicated.
1,250+
Projects shipped
10+
Years of experience
Top 3%
Upwork Top Rated Plus
5 stars
Average review score
Want results like these?
Tell us what you are building. You get a reply within 24 hours on business days, then a written estimate.
Work Culture
Why Product Teams Trust Us With Vulnerability Disclosure
Vulnerability disclosure programs work when researchers feel heard and your team isn't buried. These habits keep your channel clear, your replies quick, and the rules fair.
Researchers treated as allies
We write your policy to thank good-faith reporters instead of threatening them. Researchers who feel welcome report privately, which is the whole point.
Scope you can support
We only put in scope what your team can triage and fix. A smaller, honest scope beats a broad one you can't answer.
Replies before deadlines
Every reply has a template and a target time. Reporters hear about their report's status, so they have no reason to go public early.
Counsel reviews legal terms
Safe harbor wording is a draft for your lawyer, not legal advice. US prosecutors are told to decline good-faith research cases, but civil claims differ, so counsel decides.
One fixed price
You get a fixed price once scope and tools are agreed. Extra products or domains are quoted before we add them.
A workflow you own
The policy, templates, and queue live in your accounts. You can move to a bounty platform later without starting over.
Overview
What should a vulnerability disclosure program include?
DeveloperLook sets up a vulnerability disclosure program that sends security reports to one place your team actually watches. We write the policy and a safe harbor draft, publish a signed security.txt file, build the intake and triage routine, and run a test report through it. Setups start at $650 and take 1 to 5 weeks, with no bounty fees.
DEVELOPERLOOK
Project facts · Vulnerability Disclosure Program Setup
- Service
- Vulnerability disclosure program setup (policy, security.txt, intake, triage routine)
- Typical timeline
- 1 to 2 weeks for the policy, up to 5 with the workflow
- Platforms
- Websites, SaaS apps, mobile apps, APIs, and connected devices
- Built with
- security.txt (RFC 9116), OpenPGP, Jira, Linear or GitHub, CVSS
- Experience
- 10+ years of development experience and 1,250+ shipped projects
- Post-launch support
- 30 days of support after launch
- Communication
- Calls in US, UK, and AU business hours
- Starting price
- From $650 USD, fixed scope after a free disclosure call
Reviewed 23 Oct 2026 by Saimul Islam
Good fit
SaaS teams fielding researcher emails
Your support inbox keeps getting emails that say they found a bug and ask about a bounty, and nobody knows which are real or who should answer.
Device makers selling into the UK or EU
Your connected product must publish a security contact and response times under the UK PSTI rules, and the EU Cyber Resilience Act adds a disclosure policy.
Companies after a public bug report
Your flaw was posted publicly by a researcher after an email went unanswered, and you want a responsible vulnerability disclosure route before it happens again.
Teams answering enterprise security reviews
Your enterprise customer's security review asks for your vulnerability disclosure policy and a documented vulnerability disclosure process, and today you have neither.
Agencies and MSPs with client products
You build or host apps for clients, and you want each one to have a disclosure policy and intake without building it yourself.
Not a fit
Want paid bug hunting
You want to pay researchers per valid finding and attract many of them. A bug bounty platform suits that better, and we can set up the policy it builds on.
Need your app tested now
You want testers to attack your app on a fixed date, not wait for whatever researchers find. Our web application penetration testing services do exactly that.
Want scans every week
You want your known weaknesses found and patched on a schedule. Our vulnerability management services run the scans, rank findings, and track the fixes.
Budget under $650
Your budget is under $650 and you run one simple website. CISA's public VDP template and a security.txt file you write yourself are a fair first step.
Not sure we're the right fit?
Book a free call or message us. We'll tell you honestly whether we're the right team.
Pricing
Transparent Starting Prices for Vulnerability Disclosure Program Setup
These are starting points in USD. Your final price depends on the products in scope, your tools, and the triage help you want, and you get a fixed proposal after a free disclosure call.
For teams with one product that need a public policy and a clear reporting address.
$650one-time, USD
- Disclosure policy with a 90-day window
- Safe harbor draft for your counsel
- Signed security.txt file under /.well-known
- Reporting address with automatic acknowledgment
- Triage checklist, reply templates, and a dry run
- 30 days of support after launch
Recommended
For SaaS and app teams that need reports tracked, scored, and fixed on a timeline.
$1,550one-time, USD
- Everything in Policy and security.txt
- Up to 5 domains or products in scope
- Private queue in Jira, Linear, or GitHub
- Encrypted report form
- CVSS severity rubric for each product
- Fix tracking linked to each report
For product companies that want help running the program through its first reports.
$3,300one-time, USD
- Everything in Intake and Triage Workflow
- Up to 15 domains, apps, or devices
- Triage help for 90 days, up to 10 reports
- Acknowledgments page for credited researchers
- CVE request path and advisory template
- EU CRA and UK PSTI disclosure mapping
For Agencies
White-Label Coordinated Vulnerability Disclosure Policy Setup for Agencies
You own the client relationship. We write the disclosure policy for your client's products, set up security.txt and intake in their accounts, and train their triager. Your clients get a reporting channel without you staffing a security desk.
How the partnership works
White label: your client only ever sees your brand
- Your client
- You, the agency
- DeveloperLook
Send the client's products
List the client's domains, apps, and devices, plus who answers security email today.
- Client needs
- You share the details
- Details received
We scope the program
You get the scope, the testing rules, and a fixed price for each client.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Set up and train
We publish the policy and security.txt, build the intake, and train the client's triager.
- Done by our team
- Your brand on it
- Handed to your clientDone
Partner with DeveloperLookDelivered under your brand
Your brand on it
Policies and templates carry your name, with our team in the background.
Repeatable setup
A tested policy and workflow adapted to each client's own products.
Clean client handoff
Each client's triager is trained, so reports don't route back to you.
Fixed price per client
Every setup is priced up front, so your margin stays predictable.
The Right Technology for Your Project
Technology Stack
Reports arrive through tools your team already watches, encryption protects your sensitive details, and fixes are tracked where your engineers work.
- security.txt
Zendesk- Gmail
- Microsoft Outlook
- GnuPG
- Proton Mail
- 1Password
- Let's Encrypt
- Jira
- Linear
- GitHub
- GitLab
- GitHub Security Advisories
- CVE Program
- CVSS scoring
- Confluence
FAQ
Frequently Asked Questions
Straight answers on cost, what a disclosure program is, security.txt, and the rules that now ask for one.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
A DeveloperLook disclosure setup starts at $650, covering the policy, a safe harbor draft, a signed security.txt file, a reporting address, and reply templates. A tracked queue in Jira, Linear, or GitHub with CVSS scoring for up to 5 products costs $1,550. The $3,300 plan covers up to 15 products and 90 days of triage help. You get a fixed price after the free disclosure call.
A policy, security.txt file, and reporting address take 1 to 2 weeks, mostly waiting on your counsel's review of the safe harbor wording. A tracked triage workflow with a dry run takes 3 to 5 weeks. On the top plan, we then stay on for 90 days to help your team triage the first real reports.
It's a public promise that tells outside researchers how to report a security flaw to you and what you'll do with it. Your program pairs a published policy with a reporting channel, a triage routine, and replies on a timeline. ISO/IEC 29147 covers the disclosure side, and ISO/IEC 30111 covers the handling behind it.
It's the act of telling a vendor like you, and later the public, about a security flaw. A coordinated vulnerability disclosure process means the finder and the vendor agree when details go public, usually after a fix ships. Google Project Zero's policy, 90 days to fix with details released 30 days after a patch, is a common reference.
A responsible disclosure policy is an older name for a vulnerability disclosure policy: the rules you publish for reporting flaws to you. It asks finders to report privately and give you time to fix. Many teams now say coordinated instead of responsible, because the newer word treats researchers as partners rather than suspects.
Most people call it a VDP (vulnerability disclosure program), and older pages say responsible disclosure program. When a program pays cash for valid findings, you'll hear it called a bug bounty. A bounty is a VDP plus rewards, so the policy and workflow we set up are what a bounty can later build on.
In security, a disclosure policy is the public page that says how to report a flaw, what testing is allowed, and how quickly you'll respond. The term also appears in finance for rules on releasing company news, which this service doesn't cover. The Policy field in your security.txt file links straight to the security version.
A security.txt file is a short text file at /.well-known/security.txt, defined in RFC 9116 and served over HTTPS. It must include Contact and Expires fields, and the RFC recommends an expiry under a year away and an OpenPGP signature. We also add Policy, Encryption, and Preferred-Languages, then set a reminder before your file expires.
For many connected products, they do or come close. The EU Cyber Resilience Act requires manufacturers to enforce a coordinated vulnerability disclosure policy from December 11, 2027. The UK PSTI rules, in force since April 29, 2024, require consumer device makers to publish a security contact and response times. Your counsel confirms which rules apply to your products.
Your named triager does, using the checklist and reply templates we set up together. You get 30 days of support after launch for questions and a second opinion on tricky reports. On the Disclosure Program Launch plan, we triage alongside your team for the first 90 days, for up to 10 reports.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Free 30-min callGoogle Meet
Book a call
Book a free 30-minute call
In 30 minutes on Google Meet we walk you through how we would build it, how long it takes and what it costs. Then you get a written estimate.
Calendar not showing? Book on cal.com or send a brief.