Free tool

Free Vulnerability Disclosure Policy Generator

The generator writes a vulnerability disclosure policy with scope, safe harbor and response times, and the security.txt file that points researchers to it.

Build your policy security.txt Generator
  • Disclosure policy
  • Safe harbor
  • security.txt file
  • Publishing checklist

Build your vulnerability disclosure policy.

Complete 3 steps and copy the results in step 4.

Tell us about your organization

The page where you'll publish the policy. The security.txt file links to it.

One per line. Leave it empty to cover your website and its subdomains.

Choose how people report

Fill in at least 1 way to report. The security.txt file lists them in this order.

Your program page on a platform such as HackerOne, Bugcrowd, Intigriti or YesWeHack.

Less than a year from today. Update the file before this date.

A link to your public key, which researchers use to encrypt their reports. The file links to the key and doesn't hold it.

Set the rules

Rewards
Test methods that aren't allowed
security.txt

The file at its address on your website, and the policy at a glance.

Copy your policy and security.txt

Review the text before you publish it. It follows your answers above.

Enter your organization name to see your policy and security.txt file.

The generator writes text from your answers, RFC 9116 and common disclosure policy templates, such as the one from the US Cybersecurity and Infrastructure Security Agency (CISA). It isn't legal advice. Review the policy before you publish it, and check the safe harbor wording with a lawyer: it covers only what your organization does, not what other parties or prosecutors do.

Where to publish your policy.

Researchers look for a security page, a security.txt file or a security email. Put the policy where they look, and make sure someone answers.

  1. A page of its own. Publish the policy at a short link, such as /security or /vulnerability-disclosure-policy.

  2. Your website footer. Link the policy from the footer, next to your Privacy Policy and Terms and Conditions.

  3. The security.txt file. Upload the file to /.well-known/security.txt. Its Policy line links to the page.

  4. The reporting inbox. Set up the security email, and make sure someone reads it every business day.

  5. Your products. Under the EU Cyber Resilience Act, name the contact and the policy link in the user information of each product.

  6. A test report. Send a test report through each route, check the reply time, and review the policy once a year.

The rules

What the rules ask.

Each row names a law, a standard or a government directive, when it applies, and what it asks of your disclosure policy.

Laws and standards for vulnerability disclosure, when each applies, and what it asks
Law or standard When it applies What it asks
RFC 9116 (security.txt) Any website. It's a voluntary internet standard. A plain text file at /.well-known/security.txt, served over HTTPS, with at least 1 Contact line and an Expires date, ideally less than a year ahead.
EU Cyber Resilience Act (Regulation (EU) 2024/2847) Makers of software and connected products sold in the EU. Reporting applies from September 11, 2026, the other requirements from December 11, 2027. A coordinated vulnerability disclosure policy and a contact address for reports (Annex I, Part II), a single point of contact named in the user information (Annex II), and reports of actively exploited vulnerabilities to ENISA within 24 hours.
NIS2 Directive (EU) 2022/2555 Essential and important entities in the EU, such as cloud, hosting and digital infrastructure providers. Vulnerability handling and disclosure as part of the security measures (Article 21). National CSIRTs coordinate disclosure between researchers and companies (Article 12).
UK Product Security and Telecommunications Infrastructure (PSTI) regime Makers of connectable consumer products sold in the UK, since April 29, 2024. A published way to report security issues, and the time within which reporters get an acknowledgement and status updates.
CISA Binding Operational Directive 20-01, US US federal civilian agencies. Its policy template is a common model for companies. A published policy with the systems in scope, how to report, a commitment not to pursue legal action for good-faith research, and an acknowledgement of reports within 3 business days.
ISO/IEC 29147 and ISO/IEC 30111 Any organization. They're international standards, often asked for in security reviews. How to receive reports and publish advisories (29147), and how to confirm, fix and track each report inside your organization (30111).

Acceptable Use Policy Generator

Your Acceptable Use Policy sets the rules for everyone else.

The TermsFeed Acceptable Use Policy Generator forbids probing or testing your service without written permission, and asks users to report vulnerabilities to you. Your disclosure policy gives that permission to researchers who follow it.

Generate Acceptable Use Policy

Frequently asked questions.

Answers to common questions about vulnerability disclosure policies.

What is a vulnerability disclosure policy?

A vulnerability disclosure policy tells security researchers how to report a vulnerability they find in your systems, and what you'll do with the report.

A policy usually covers the following.

  • The systems in scope, and the ones that aren't.
  • The test methods that aren't allowed, such as denial of service.
  • How to report, and what to include.
  • How fast you reply, and when the details go public.
  • A promise not to take legal action against good-faith research, known as safe harbor.

Do I need a vulnerability disclosure policy?

Some laws ask for one, and every website benefits from one.

  • The EU Cyber Resilience Act asks makers of software and connected products sold in the EU for a coordinated vulnerability disclosure policy, from December 11, 2027.
  • The UK PSTI regime asks makers of connectable consumer products to publish how to report security issues.
  • The EU NIS2 Directive counts vulnerability disclosure among the security measures of essential and important entities.

Without a policy, a researcher who finds a vulnerability doesn't know who to tell, and sometimes publishes it without telling you.

Is a vulnerability disclosure policy the same as a bug bounty program?

No. A vulnerability disclosure policy invites reports. A bug bounty program invites reports and pays for them.

  • A policy is free to publish, and works on its own.
  • A bug bounty program adds rewards, often run on a platform such as HackerOne or Bugcrowd, under the rules the platform sets.

Most organizations start with a policy and add rewards later.

What does safe harbor mean in a disclosure policy?

Safe harbor is your promise that research which follows the policy is authorized, and that you take no legal action against it.

  • It covers what your organization does.
  • It doesn't stop other parties, such as a hosting provider or prosecutors, from acting.
  • The research has to follow the policy: the scope, the test methods and the disclosure rules.

Check the wording with a lawyer before you publish it.

How fast should we reply to a report?

Many policies confirm they received a report within 3 business days, as in the CISA template.

  • Choose reply times your team meets every time: a missed reply is the most common reason researchers publish early.
  • The UK PSTI regime asks you to publish your reply times, not to meet a set number of days.
  • A deadline of 90 days before the details are made public is common.

Is the Vulnerability Disclosure Policy Generator free?

Yes, the Vulnerability Disclosure Policy Generator is free.

  • The generator needs no account.
  • The generator writes the security.txt file too.

Build your policy with the generator above.