Kit vs YesWeHack: Researcher services and report tracking
YesWeHack offers a researcher community, managed services and CVE issuance. Kit gives your team the intake, response deadlines and bounty records to handle reports itself. It supplies no researchers.
Which fits your team?
Kit fits teams that need:
- A record of their disclosure process
- Published monthly billing
- Intake for independently arriving reports
- Researcher paperwork and bounty records
- A policy page, security.txt and response deadlines
YesWeHack fits teams that need:
- Researchers actively testing their assets
- Its documented EU hosting and vendor certifications
- Bug bounty or accredited pentests
- A managed triage team
- REST access and tracker integrations
- A contracted testing service
What YesWeHack does well
A researcher community, vendor certifications and further testing services.
A researcher community
YesWeHack reports more than 160,000 ethical hackers and promotes Featured VDPs to that community.
In practice: Kit provides intake for researchers who find you independently.
EU hosting and certifications
YesWeHack documents EU hosting in a SecNumCloud-qualified private cloud, ISO 27001 and 27017, and CREST accreditation.
In practice: Those credentials may meet procurement requirements that Kit cannot satisfy today.
Bug bounty, pentesting and CVEs
YesWeHack offers services beyond VDP, including bug bounty, pentesting and CVE issuance as a CNA.
In practice: Teams can buy further testing from the same vendor. Kit provides no testing service or CVE issuance.
What Kit includes
Each report gets a deadline and a reminder, so none sits unanswered while you ship. Kit brings no researchers or managed triage.
Researchers see missing payout paperwork
The report page shows whether an agreement, tax form or payout details are missing. Researchers accept the recorded agreement by clicking a button. Rejected tax forms include a reason.
Researchers can complete the missing step from their own report page.
The next action on each report
Kit highlights the current step: Assignment, Assessment, Decision or Bounty. Moving a report backward requires a comment. Idle reports trigger reminders, then an escalation to admins.
The report shows what needs doing, and its owner cannot mute the final escalation.
Triage tools for your assistant
Connect an MCP client to read reports and use guided prompts for triage, assessment, bounty approval and postmortems. Write access requires consent and the appropriate role.
Researcher replies are saved as drafts unless an admin enables direct sending. Reporter text is marked as untrusted.
Published monthly pricing
Security is part of the $8 Kit seat. There is nothing extra to buy.
You can calculate the subscription cost before contacting sales.
What Kit doesn't have
Check these limits before choosing Kit.
REST access and tracker sync
YesWeHack documents an API and synchronizes reports with GitHub, GitLab, Jira and ServiceNow. Kit's security queue uses MCP and webhooks, with no REST API.
Will we add it? A security REST API is not scheduled.
CVE issuance
YesWeHack is a CVE Numbering Authority. Kit cannot reserve or issue CVEs.
Will we add it? No. Kit does not plan to become a CNA.
Custom portal translations
YesWeHack supports customer-supplied translations for VDP pages. Kit's portal supports five languages; its security.txt advertises English.
Will we add it? Additional maintained locales may be added. Customer-supplied portal translations are not planned.
A researcher community
YesWeHack reports more than 160,000 researchers and shows Featured VDPs to its community. Kit recruits no researchers; people find your published form or security.txt.
Will we add it? No. Kit will not run a researcher marketplace.
Vendor certifications
YesWeHack holds ISO 27001 and 27017, CREST accreditation and hosting in a SecNumCloud-qualified private cloud. Kit holds none of these and runs on one server in Nuremberg.
Will we add it? CREST accreditation and SecNumCloud qualification are not planned.
How each works
The difference in day-to-day use.
For whoever answers security reports on top of their job
Every $8 Kit seat includes the Security workflow: intake, triage, SLAs, bounty records, and exports. Your team validates findings and handles any payouts.
Researchers and testing services
YesWeHack offers researcher access, managed VDPs, bug bounty and pentesting. Its hosting and certifications support buyers with specific vendor requirements.
Plans and costs
Kit
$8/seat/month
Published prices, monthly billing, cancel anytime
- Security workflow included in every seat
- Triage board, 72-hour acknowledgment clock and exports for your own SOC 2 audit
- Anonymous submissions plus an embeddable intake form
- Bounty matrix, append-only ledger, W-9 / W-8BEN collection
- Slack, Jira, Linear, PagerDuty and Vanta integrations
YesWeHack
Contact sales for a quote
Request a quote for the service and support you need
- Managed VDP pricing available from sales
- MyOpenVDP is a separate, free tool you host yourself
- API via personal access tokens; API apps are enabled by your account manager
- Some triage communication depends on subscription
- Its VDP offering excludes bounty rewards
Plans and costs
Kit publishes its $8/seat/month price and includes the Security workflow. Your team handles triage and any bounty payments.
Switching from YesWeHack?
Consider Kit for:
- Evidence of a disclosure process
- Published monthly pricing
- Bounty records and researcher paperwork
- Security workflow included in every seat
- A published policy page and security.txt
Stay with YesWeHack if:
- Require its documented EU hosting and certifications
- Want researchers testing your assets
- Need bug bounty and accredited pentests from one vendor
- Use its REST API or tracker integrations
Data portability: YesWeHack exports reports as CSV, XLS, JSON and PDF. Export before ending your contract.
$8€6,9929,99 zł£5.99 per seat, per month
Get started free