Business & contracts 2 signers 2 pages 13 blanks to fill in

Vulnerability Disclosure Agreement Template

Work with a security researcher on clear terms: what they may test, how they report, when they can publish and what you pay.

Use this template — free See the agreement Signers don’t need an account
Vulnerability disclosure agreement
The blanks in brackets are what you fill in. FileIt adds each signer’s signature and date boxes.
Vulnerability disclosure agreement — page 1 of 2
Page 1 of 2
Vulnerability disclosure agreement — page 2 of 2
Page 2 of 2
Use this template Fill in the blanks, name who signs, and send — from FileIt eSignature.

What is a vulnerability disclosure agreement?

When a security researcher finds a flaw in your app, both of you want the same thing, a quiet fix before anyone exploits it, but you may not trust each other yet. The researcher worries about being threatened with legal action for testing. You worry about data being copied or the bug appearing on social media before there is a patch. A short disclosure agreement turns that uncertainty into a process.

This template defines the systems in and out of scope and any test environment, and lists testing rules: no access to other people's data beyond the minimum, no disruption, no social engineering and no extortion. It gives good-faith research a safe harbour from the company, sets acknowledgement and update times, and keeps flaws confidential until fixed or until a disclosure date you choose, with notice before publication. There is credit for the researcher and an optional bounty by severity.

Best for
Software companies working with an individual security researcher
Signed by
The company and the researcher
Disclosure
After a fix, or a set number of days after the report
Length
About 2 to 3 pages

When to use a vulnerability disclosure agreement

  • A researcher has emailed about a possible flaw and you want terms before they share details
  • Inviting a trusted researcher to test a new product before launch
  • Agreeing a bounty with someone who found a serious bug in your API
  • A small SaaS company without a public bug bounty programme setting one up for one researcher
  • Putting a long-running informal arrangement with a researcher on a written footing

What you fill in

13 blanks, then the name and email of each person who signs: company, security researcher.

1 The parties

  • Date of this agreement*
  • Company*
  • Researcher (legal name)*
  • Researcher's public name or handle
  • Where to send reports*

2 Scope

  • Systems in scope*
  • Out of scope*
  • Test accounts or environment

3 Timeline

  • Company acknowledges a report within (days)*
  • Earliest public disclosure (days after the report)*

4 Bounty

  • Bounty* No bounty · Bounty by severity, as set out below
  • Bounty amounts
  • Governing law*

5 Who signs

  • Company signature and date, job title
  • Security researcher signature and date

What the vulnerability disclosure agreement covers

  1. Scope
  2. Rules of testing
  3. Safe harbour
  4. Reporting
  5. Confidentiality and disclosure
  6. Bounty
  7. General

Using the vulnerability disclosure agreement, step by step

1 Name the parties and reporting address

Enter the company, the researcher and, if they want credit, their public handle. Give the security email address reports go to.

2 Define the scope

List the domains, apps and versions that may be tested and what is off limits. Add a staging environment or test accounts if you provide them.

3 Set the timeline

Choose how quickly you acknowledge a report and the earliest day the researcher may publish. 90 days is common.

4 Decide on a bounty and sign

Choose no bounty, or enter amounts by severity. Then send it to the researcher to sign before testing starts.

Tips before you send it

  • Publish a security.txt file and a short disclosure policy on your website as well. This agreement suits one-to-one arrangements.
  • Check whether your cloud or hosting provider requires notice before testing. The safe harbour cannot bind them.
  • Answer reports quickly. Most disclosure disputes start with a researcher who feels ignored.
  • Keep a log of each report, your assessment and the fix date. It helps when you write the advisory.

Sign it online in minutes

  1. Fill in the blanks. Names, dates and amounts go straight into the agreement — the preview shows exactly where.
  2. Name who signs. Tick “This is me” for your own part. FileIt builds the PDF with every signature, date box on the right line, and you can check or move anything before sending.
  3. Send it. Each signer gets a secure link and signs from any device — no account needed. The signed PDF, with an audit trail and a Certificate of Completion, is filed in your vault and emailed to everyone.
Use the vulnerability disclosure agreement template — it’s free

Vulnerability disclosure agreement: frequently asked questions

What is safe harbour in vulnerability disclosure?

A promise from the company that it treats good-faith research within the agreed rules as authorised and will not take legal action or complain to the authorities about it. It covers only the company's own rights, not third parties'.

When can the researcher publish the vulnerability?

Once it is fixed, or after the number of days you set from the report, whichever comes first. They give you 7 days' notice and a copy of what they will publish first.

Do we have to pay a bug bounty?

No. You can choose no bounty. If you pay one, enter amounts by severity. It is due for the first valid report of a flaw you did not already know about.

What if the researcher accesses customer data?

They must stop as soon as they reach other people's data, take no more than needed to prove the issue, and delete it after reporting. Breaking these rules ends the safe harbour for that activity.

Use this template — free