Your first vulnerability disclosure program. Live in 5 minutes.

A VDP isn't a bug bounty: you're not offering rewards. It's a documented, compliant channel for researchers to report vulnerabilities. SOC 2 Type II, cyber insurers, and enterprise customers increasingly require proof that you have one. Kit's free tier gives you exactly that, with no commitment to pay anything.

Researchers are already looking. What a VDP changes is where the finding lands. Without published safe harbor terms, reporting to you is a legal risk, so a well-meaning researcher goes public instead. Publish the terms and they come to you first.

Yes. Switch your portal to invite-only mode in Security Portal Settings and Kit generates a secret access token. Share the invite URL directly with trusted researchers. It grants them a persistent session on click. Anyone else who visits the portal sees a short access request form instead of a dead end. Pending requests appear in your sidebar with a badge; one click approves the request and sends the researcher their invite link automatically.

Kit's intake form runs CAPTCHA and rate limiting, then scores what survives for fabricated CVEs, hallucinated functions, and template language. More than 80% of the noise is filtered before it reaches your queue.

Every incoming report is screened with a confidence score and named signals: fabricated CVEs, hallucinated functions, template language. Flagged reports are marked for review before they cost your team a minute. Combined with CAPTCHA and rate limiting, more than 80% of noise never reaches your queue.

A form gets you intake. It doesn't give you SLA tracking, CVSS scoring, status history, researcher communication threads, bounty payments, tax document handling, or one-click SOC 2 export. Kit bundles all of that, so you spend an afternoon deploying it, not an engineering sprint building it.

Perfect. Vanta and Drata track that you have a VDP. Kit runs it. Enable Kit's VDP, point your compliance tool at your published security.txt, and the box is checked with a real program behind it. On the add-on, Kit also syncs confirmed reports into Vanta as vulnerability evidence for SOC 2 CC7.1 and ISO 27001 A.8.8. Resolve a report in Kit and Vanta records it remediated on the next sync.

Kit started in hiring, but the machinery underneath is the same: structured intake, an SLA clock, an audit export. The VDP points it at a different queue. We run our own disclosure program on it.

When a critical report arrives, Kit notifies your team immediately. From there: you triage it, score it with CVSS v3.1, message the researcher in one thread, assign an owner, and run it against the SLA clock. When your auditor asks for evidence, the whole timeline exports.

Triage. Each report posts one live card that Kit edits in place, with the history hanging in its thread. From Slack your team can assign a report, acknowledge it (which stops the acknowledgment SLA clock), accept or reject an appeal, take over a component report, snooze a stall reminder, or mark it waiting on the researcher. Every click is re-authorized against the clicker's affirmed Slack identity and the same permission checks as the app.

Mark a report restricted and it never posts to Slack: no card, no thread. A channel audience isn't a Kit permission, so nothing sensitive is ever left to channel hygiene. If a report becomes restricted after its thread exists, Kit tombstones the thread. Bot replies are deleted and the root message is replaced with a neutral notice carrying no title, no report id, and no link. On-call paging still fires so the SLA clock isn't orphaned, but by email only, with no report details in the alert.

Yes. Every report exports as an incident dossier PDF: executive summary, full timeline, CVSS breakdown, postmortem, evidence manifest, and sign-off page. One click, one file, ready for the audit binder.

HackerOne and Bugcrowd both offer free submission forms. Kit's free tier does too. The difference is what happens after a report arrives: Kit adds SLA clocks, CVSS v3.1 scoring, kanban triage, a researcher thread, bounty disbursement, and SOC 2 exports for $49/mo on top of a seat. When you outgrow Kit, your whole program history exports as CSV or PDF — report summaries, CVSS scores, SLA performance, communication logs, and the financial ledger.

Yes. Kit's full account export packages every VDP record — programs, reports, assessments, messages, bounty awards, disbursements, researcher profiles, and screening results — into structured JSON. One click from Account Settings. You have 7 days to download the archive. Your security history is yours.