VDP
Vulnerability disclosure policy
A public statement of how to report vulnerabilities to an organization, which systems are in scope, what testing is authorized under safe harbor and what reporters can expect in return; CISA BOD 20-01 required one from US federal civilian agencies, and a security.txt file (RFC 9116) points to it.
Covered in
Start with a VDP, then add bug bounties and penetration tests
Publish a vulnerability disclosure policy and security.txt first, add a bug bounty only when you can triage and fix at the pace rewards bring, and buy penetration tests with a written scope, rules of engagement and a retest.
Run coordinated vulnerability disclosure from report to advisory
Make private reporting discoverable, verify reports, coordinate a tested remedy, and give affected users enough information to act.
Set up a PSIRT: services, intake, triage, SLAs and the CNA role
How to structure and run a product security incident response team on the FIRST PSIRT Services Framework: organizational models, intake channels, triage, response targets, a case record and SLA script, becoming a CVE Numbering Authority under the CNA rules 4.2.0, and coordinating with other vendors.