A public policy inviting security researchers to report vulnerabilities in your website, app, software or connected product safely – scope, how to report, safe harbour, what researchers must not do and response timescales – with an internal handling procedure and security.txt file.
Tech & SaaS
Vulnerability Disclosure Policy
About this document
People who find security weaknesses in your systems need a safe, clear way to tell you. A vulnerability disclosure policy tells them how to report, what is in scope and how you will respond – so problems are fixed before criminals exploit them. The NCSC recommends every organisation has one, and manufacturers of consumer connectable products (smart devices) must publish a way to report security issues under the Product Security and Telecommunications Infrastructure regime.
The document is laid out in the sections below. Each one comes with a plain-English guidance note explaining what it does and what to change.
Our templates are professionally structured starting points for UK businesses, not legal advice. For anything complex, unusual or high-value, have your final version checked by a solicitor.
Included in the pack
Tech & SaaS
for every document in this category
Editable Microsoft Word files
Guidance notes in every document
Written for UK businesses
Download and keep
Need more than one category?
Documents All-Access gives you every category for 12 months for £295.
Compare options →Need it tailored?
We can adapt any template to your business, or write a document from scratch.
Talk to us →
