Your first vulnerability disclosure program. Live in 5 minutes.

A VDP isn't a bug bounty - you're not offering rewards. It's a documented, compliant channel for researchers to report vulnerabilities. SOC 2 Type II, cyber insurers, and enterprise customers increasingly require proof that you have one. Kit's free tier gives you exactly that, with no commitment to pay anything.

Researchers are already probing your infrastructure - they just have nowhere legitimate to send what they find. A VDP gives them a sanctioned path and provides you legal safe harbor. Without one, a well-meaning researcher might go public rather than risk legal exposure. With one, they come to you first.

Yes. Switch your portal to invite-only mode in Security Portal Settings and Kit generates a secret access token. Share the invite URL directly with trusted researchers - it grants them a persistent session on click. Anyone else who visits the portal sees a short access request form instead of a dead end. Pending requests appear in your sidebar with a badge; one click approves the request and sends the researcher their invite link automatically.

Kit's intake form includes CAPTCHA, rate limiting, and an AI screening layer that catches junk before it reaches your queue. In practice, more than 80% of noise is filtered automatically. You'll see real reports - not inbox chaos.

Every incoming report is screened with a confidence score and named signals - fabricated CVEs, hallucinated functions, template language. Flagged reports are marked for review before they cost your team a minute. Combined with CAPTCHA and rate limiting, more than 80% of noise never reaches your queue.

A form gets you intake. It doesn't give you SLA tracking, CVSS scoring, status history, researcher communication threads, bounty payments, tax document handling, or one-click SOC 2 export. Kit bundles all of that - so you spend an afternoon deploying it, not an engineering sprint building it.

Perfect. Vanta and Drata track that you have a VDP - Kit runs it. Enable Kit's VDP, point your compliance tool at your published security.txt, and the box is checked with a real program behind it. On the add-on, Kit also syncs confirmed reports into Vanta as vulnerability evidence for SOC 2 CC7.1 and ISO 27001 A.8.8 - resolve a report in Kit and Vanta records it remediated on the next sync.

Kit started as a hiring platform, but compliance infrastructure shares the same engineering DNA - structured intake, SLA tracking, workflow automation, and audit exports. We built the VDP on the same foundation, applied to a different workflow. Kit runs its own VDP on this platform. Our security.txt is live. Our disclosure policy is published. We triage every report that comes in.

When a critical report arrives, Kit sends an immediate notification to your team. From there: you triage the report, assess severity with CVSS v3.1 scoring, communicate with the researcher through threaded messages, assign it to the right person, track resolution against your SLA timer, and export the full audit trail when your auditor asks for evidence. The entire lifecycle is documented, timestamped, and exportable.

Yes. Every report exports as an incident dossier PDF: executive summary, full timeline, CVSS breakdown, postmortem, evidence manifest, and sign-off page. One click, one file, ready for the audit binder.

HackerOne and Bugcrowd both offer free submission forms. Kit's free tier does too. The difference is what happens after a report arrives: Kit gives you SLA tracking, CVSS scoring, kanban triage, researcher communication, bounty payments, and SOC 2 exports at $49/mo. HackerOne's managed programs with equivalent operational features start at $22K+/yr. When you outgrow Kit, we export your full program history - report summaries, CVSS scores, SLA performance, communication logs, and financial ledger - as CSV or PDF. No migration headaches.

Yes. Kit's full account export packages every VDP record - programs, reports, assessments, messages, bounty awards, disbursements, researcher profiles, and AI screenings - into structured JSON. One click from Account Settings. You have 7 days to download the archive. Your security history is yours.