Metrics and Exports

Why It Matters

Metrics are the primary mechanism for proving VDP effectiveness to auditors. “We have a vulnerability disclosure program” is not sufficient evidence. “We acknowledged 100% of reports within 72 hours and resolved critical issues within 48 hours” is.

SOC 2 Type II evidence requires time-bounded data: reports received, SLA compliance rate, severity distribution, and resolution times. Kit’s metrics dashboard and export pipeline are designed to produce exactly what your auditor asks for — without a scramble at quarter-end.

Dashboard KPIs

Five headline metrics appear at the top of your VDP dashboard. These give you an at-a-glance health check every time you open the module.

KPI	Description
Open Reports	Count of reports not yet resolved or dismissed
Awaiting Triage	Reports in Submitted status with no assessment
SLA Compliance %	Percentage of reports acknowledged within the configured SLA
Bounties Approved	Total approved bounty value this period (VDP Add-on only)
AI Flagged	Count of reports with an AI slop flag awaiting human review

KPIs refresh on page load. There is no auto-refresh — reload the page or navigate back to see updated numbers.

Every figure — the dashboard KPIs and everything on the metrics page — counts only reports you can open. Reports restricted to specific teammates enter the numbers for their grantees and admins alone, so your dashboard and Kit’s AI tools always report the same totals.

Metrics Page

Navigate to VDP > Metrics for detailed analytics. Use the period selector at the top to scope the data to the last 7, 30, or 90 days. These three ranges are the only options — there is no custom date picker on the metrics page.

The metrics page is divided into eight sections:

Section	What It Shows
MTTA (Mean Time to Acknowledge)	Average hours from submission to first response, across the reports visible to you in the period
MTTR (Mean Time to Resolve)	Average hours from submission to resolution, across the reports visible to you in the period
SLA Compliance	A single compliance percentage stat — the share of reports acknowledged within the configured SLA. Watch it dip below your target before it becomes an audit finding
Reports Over Time	Bar chart of submissions per week or month — useful for spotting seasonal patterns or disclosure spikes
By Severity	Breakdown of reports by severity tier (Super Critical through Informational)
By Status	Distribution of all reports submitted in the period, grouped by their current status (Submitted, Triaged, Validated, In Progress, Resolved, etc.)
By Vulnerability Type	OWASP category distribution — shows which vulnerability classes your product is most exposed to
Top Researchers	Ranked by total report count — identifies your most active external contributors

All sections respect the selected date range. MTTA and MTTR are the two numbers your SOC 2 auditor will ask about first.

Researcher Karma

Kit tracks researcher quality over time using a karma system. Navigate to VDP > Researchers for the full researcher directory with karma tiers.

Karma Tier	Meaning	How It Appears
Trusted	Consistently valid, high-quality reports	“Trusted” badge on the researcher’s profile and beside their reports
Neutral	No strong signal either way	“Neutral” badge
Low	History of low-quality reports	“Low” badge signalling extra scrutiny is warranted
Untrusted	Pattern of spam or bad-faith submissions	“Untrusted” badge marking the researcher for careful manual review

Karma adjusts automatically based on events tied to the researcher’s submissions. Most events fire when a report moves through its lifecycle or is dismissed with a specific reason.

Positive events (increase karma):

• Report triaged
• Report validated
• Report resolved
• Bounty awarded for a confirmed vulnerability (higher-severity awards earn a bonus)
• Report dismissed as a valid duplicate of a real, already-reported issue

Negative events (decrease karma):

• Report dismissed as spam
• Report confirmed as AI slop

Beyond these automatic events, a triager (or the AI assistant) can apply a manual karma adjustment — positive or negative — from a fixed set of reasons, for cases the automatic rules do not cover.

Karma tiers help your team prioritize triage. A report from a Trusted researcher can be fast-tracked with higher confidence. A report from an Untrusted researcher still enters the queue but is flagged so your team can apply appropriate scrutiny.

Hall of Fame Management

Navigate to VDP > Hall of Fame to manage the public researcher leaderboard. The Hall of Fame recognizes researchers who have contributed valid reports to your program.

Key rules:

• Nobody is listed without consent, and nobody is listed automatically either. Your team adds every entry by hand — for a researcher who set their recognition preference in the portal, who answered a consent request you sent them, or whose consent you recorded from a report thread or an email
• A researcher who chose Not listed cannot be added at all. That refusal is final and nothing on this page overrides it
• Staff can Feature a researcher, which pins them to the top of the public page
• Staff can Remove an entry from the leaderboard. That takes the entry down; it does not change the researcher’s recognition preference, so the same researcher can be credited again later

If a researcher has never answered the recognition question, you can send them a consent request from their profile instead of waiting — see The Researcher Portal for the four recognition states and how that request works.

The public Hall of Fame is available at /security/{program-slug}/hall-of-fame. Share this URL in your disclosure policy to signal that you value researcher contributions. Most programs publish the Hall of Fame once they have five or more credited researchers.

Generating Exports

There is no separate Exports page. Instead, one-click Download CSV and Download PDF buttons live on the pages where the underlying data already appears:

• Metrics (VDP > Metrics) — the export is scoped to the period currently selected on the page (last 7, 30, or 90 days)
• Ledger (VDP > Ledger) — exports the full financial and report trail with no date scoping (all-time)
• Disbursements (VDP > Disbursements) — exports from the payouts view, also with no date scoping (all-time)

Exports require the VDP Add-on ($49/mo). Only the Metrics page’s export is date-scoped; there are no status, severity, or vulnerability-type filters anywhere — every export simply covers every report in scope (the selected period on Metrics, or all-time from Ledger/Disbursements).

Choose your format:

Format	Best For
CSV	Machine-readable data for spreadsheets, further analysis, or import into GRC tools
PDF	Human-readable report formatted for auditors — includes headers, summaries, and tables

Each export includes four sections:

Section	Contents
Report Summaries	Report ID, title, status, severity, CVSS score, vulnerability type, submission date, resolution date
SLA Performance	Per-report SLA status, submission time, SLA deadline, and elapsed hours
Communication Log	External messages only (researcher-facing communications, not internal notes)
Financial Ledger	Bounty approvals, disbursement records, and payout amounts for the period

Exports are asynchronous. Clicking a download button opens the export’s status page, which updates live (via Turbo Stream) as Kit builds the file in the background — no email is sent. When processing finishes, a download link appears on that page. Large exports covering several quarters of data may take a few minutes, and the generated file is available for 7 days before it expires.

SOC 2 Evidence Workflow

The recommended workflow for SOC 2 Type II audits:

1. At the end of each quarter, open VDP > Metrics, select the 90 days period (the closest approximation of a quarter), and use the export buttons — or open VDP > Ledger for the complete, all-time financial trail alongside the quarter’s report data
2. Click Download PDF for the primary evidence file, then Download CSV as a supplement
3. Wait for each export’s status page to finish processing, then use the download link that appears
4. Attach both files to your CC4 (Monitoring Activities) and CC7 (System Operations) evidence folders

Your auditor will look for three things in this export: that reports are being received and tracked, that SLA targets are being met consistently, and that the financial ledger shows a clean trail from bounty approval through disbursement. The export is designed to answer all three questions without additional preparation.

See Bounties and Payouts for details on the financial ledger that feeds into exports.

Quick Checklist

• Review Dashboard KPIs at the start of each week to catch SLA compliance drops early
• Check the Metrics page at the start of each quarter to confirm MTTA and MTTR trends
• Review researcher karma tiers to identify Trusted researchers for expedited triage
• Publish the Hall of Fame once you have 5+ credited researchers
• Generate a quarterly export for your SOC 2 CC4/CC7 evidence folder (VDP Add-on)
• Set a recurring calendar reminder to pull metrics before each SOC 2 audit window
• Cross-reference the Triaging Reports workflow if SLA compliance is trending down

Next Steps

• Triaging Reports — the full triage workflow, SLA indicators, and bulk operations
• AI Integration — ask the AI assistant for metrics summaries and SLA analysis