Vulnerability Disclosure Programs in India: A 2026 Setup Guide

Someone is already looking at your attack surface. Not on your schedule, not in a signed engagement — just a researcher who found an open S3 bucket, an IDOR in your mobile API, or a leaked key in a JavaScript bundle. The only question is what happens next. With no published channel, they either drop it on Twitter, sell it, or walk away. With a clear vulnerability disclosure program, they tell you first. This guide covers how to set one up in India in 2026 — the difference between a VDP and a bug bounty, the IT Act legal angle that keeps Indian researchers nervous, and an honest assessment of whether your team is ready to run one.

VDP, bug bounty, coordinated disclosure: three different things

These terms get used interchangeably and they should not be. Getting the distinction right is the first decision a CISO has to make.

• Vulnerability Disclosure Program (VDP) — a published policy that invites anyone to report security issues through a safe, legal channel. No payment. The “reward” is recognition (a hall of fame, a thank-you, a CVE credit). It is the floor every internet-facing company should have.
• Bug bounty program — a VDP plus money. You pay researchers per validated, in-scope finding, usually scaled by severity. It attracts far more attention and far more noise, and it only makes sense once your triage and remediation pipeline is mature.
• Coordinated (responsible) disclosure policy — the rules of engagement that sit inside both: how long a researcher waits before going public, who they coordinate with, and what you both commit to. It governs the timeline; the VDP/bounty governs the channel and reward.

In short: coordinated disclosure is the process, a VDP is the no-cash channel, and a bug bounty is a VDP with a budget. Almost every Indian company building a program should start at the VDP end and earn the right to add bounties later.

Why Indian companies need a VDP now

The regulatory floor has risen sharply. CERT-In’s 2022 directions require reporting a covered cyber incident within 6 hours of becoming aware of it, retention of logs for 180 days, and cover 20 categories of reportable incidents — our CERT-In directions guide breaks down what that means operationally. The DPDP Act 2023, with Rules notified on 13 November 2025 and full compliance due by 13 May 2027, carries a maximum penalty of ₹250 crore. Against that backdrop, India saw more than 2.2 million cyber incidents between 2021 and mid-2025 and remains a top-five ransomware target geography.

The strategic logic follows directly: the cost of an attacker finding a bug before you do has gone up by orders of magnitude, while the cost of a researcher reporting it to you for free has not. A VDP converts hostile discovery into early warning. It is one of the cheapest forms of continuous external testing you can put in place — provided you can act on what arrives.

The legal angle: authorization is everything in India

This is the part Indian programs get wrong most often, and it is the single biggest reason researchers ignore unprotected targets. India has no statutory safe-harbour for security researchers. Unauthorized access to a computer resource is a civil contravention under Section 43 of the IT Act 2000 (penalty up to ₹1 crore for accessing or damaging a system “without permission”), and it becomes a criminal offence under Section 66 — punishable by up to three years’ imprisonment and/or a fine up to ₹5 lakh — when the same act is done “dishonestly or fraudulently” (terms the Act ties to the definitions in the penal code).

Read that carefully, because the wording is what your VDP leverages. The line between lawful testing and a crime is authorization and intent. A researcher acting within a scope you have published in writing is no longer accessing your systems “without permission,” and reporting a bug for you to fix is not acting “dishonestly or fraudulently.” A clearly worded VDP with an explicit safe-harbour statement is the document that establishes both. Without it, even a well-meaning report can be treated as evidence of unauthorized access — and Indian researchers know it, which is exactly why so many stay quiet.

Practically, your safe-harbour statement should say that you will not pursue legal action against researchers who act in good faith, stay within the published scope, do not exfiltrate or destroy data, and give you reasonable time to remediate before disclosing. This is a contractual commitment from you, not a shield granted by law — so have your legal counsel draft and review the exact language before you publish. Do not copy a US-style safe-harbour verbatim; the IT Act framing is different.

A VDP complements VAPT — it does not replace it

A common misread is treating a VDP as a cheaper substitute for paid testing. It is not. The three approaches answer different questions and you need all three working together.

A scheduled VAPT engagement gives you a deep, methodical, contracted assessment with a report you can show an auditor; a VDP gives you continuous, opportunistic coverage between those engagements. Use both. If you are scoping the pentest side, our web application penetration testing checklist is a good starting point for what a thorough assessment should cover.

The building blocks of a VDP

A credible program is more than a security.txt file. These are the components researchers look for before they decide you are worth reporting to:

1. Scope — exactly which domains, apps, APIs, and IP ranges are in bounds, and what is explicitly out (third-party SaaS, production data exfiltration, denial-of-service, social engineering).
2. Safe-harbour statement — your good-faith authorization and commitment not to pursue legal action, drafted with counsel as above.
3. Reporting channel — a dedicated address (a /.well-known/security.txt file plus a monitored security@ inbox or a form), not a generic support queue.
4. Response SLAs — committed times to first acknowledgement (e.g. 3 business days), to triage, and to resolution. Publish them and meet them.
5. Triage process — who validates reports, reproduces them, and routes them to engineering. This is the part that breaks programs; budget for it.
6. Severity / CVSS — a consistent rubric (CVSS is the standard) so researchers and your team agree on impact.
7. Disclosure timeline — how long you ask researchers to hold before going public (90 days is a common default) and your commitment to coordinate.
8. Recognition vs reward — for a VDP, recognition: a hall of fame, swag, CVE credit, a reference letter. Reward (cash) is the step up to a bounty.

Self-host or use a platform?

For a pure VDP, self-hosting is entirely viable: a security.txt file, a monitored inbox, a tracking ticket queue, and a published policy page cost almost nothing and keep you in full control of the data. The catch is operational discipline — someone has to own the inbox and the SLAs.

Managed platforms add structured intake, deduplication, researcher reputation signals, payout handling, and a triage layer that filters noise before it reaches your engineers. That convenience matters most once volume climbs or you move to paid bounties. Start self-hosted for a VDP; consider a platform when you graduate to a bounty or when report volume outpaces your team. Validate any platform’s current pricing and India data-residency posture directly with the vendor before committing.

Common mistakes

• Launching with no capacity to fix. A VDP that collects reports it never resolves is worse than none — it tells researchers (and eventually the public) that you were warned and did nothing. That is a far worse story than not having a program at all.
• Vague or missing scope. Ambiguity pushes researchers toward your blind spots and your legal team toward conflict.
• No safe-harbour, or a borrowed US template. Without IT-Act-aware language, Indian researchers will not engage.
• Silent treatment. No acknowledgement within days is the fastest way to push a finding to public disclosure.
• Arguing severity to dodge fixing. Researchers talk to each other; a reputation for downgrading kills participation.
• Treating it as a VAPT substitute. It is a complement, not a replacement.

Step-by-step launch checklist

1. Confirm internal capacity — a named triage owner and an engineering commitment to remediate. If you cannot staff this, stop here.
2. Draft the scope: in-scope assets, out-of-scope assets, prohibited actions.
3. Have legal counsel write your IT-Act-aware safe-harbour statement.
4. Stand up the reporting channel: publish security.txt and a monitored inbox or form.
5. Define and publish SLAs and your CVSS-based severity rubric.
6. Document the coordinated disclosure timeline.
7. Decide recognition (hall of fame, CVE credit) — keep cash out until the pipeline is proven.
8. Run an internal dry run: feed a known issue through the whole flow end to end.
9. Publish quietly, monitor the first reports, then promote the program.
10. Review quarterly: time-to-fix, report quality, scope gaps — and only then consider a paid bounty.

Frequently Asked Questions

Is running a bug bounty legal in India?

Yes. Nothing in Indian law prohibits inviting researchers to test your systems. The legal risk runs the other way — at the researcher, who can face liability under IT Act Sections 43 and 66 for unauthorized access. Your published authorization and safe-harbour statement is what removes that risk and makes participation safe, which is why getting the legal language right matters more than the payout.

Does a VDP satisfy CERT-In or DPDP requirements?

Not on its own. A VDP is a sound security practice and supports your overall posture, but it does not replace incident-reporting obligations, log retention, or the documented assessments those frameworks expect. Pair it with scheduled VAPT and a tested incident-response process — see our CERT-In guide for the reporting specifics.

How much should we pay researchers?

For a VDP, nothing — recognition only. If you move to a bounty, scale payouts by validated severity and benchmark against comparable Indian programs rather than copying global rates. Start conservative; you can always raise rewards, but cutting them damages trust.

What if we get a report we cannot reproduce or fix?

Acknowledge it, explain your assessment honestly, and keep the researcher informed. Disputes over severity or reproducibility are normal; silence and dismissiveness are what turn a private report into a public one.

A vulnerability disclosure program is one of the highest-leverage, lowest-cost security investments an Indian company can make in 2026 — but only if it is backed by the capacity to triage and fix, and by legal language that actually protects researchers under Indian law. If you want help designing a VDP, drafting the scope and safe-harbour statement, or running the VAPT engagements that should sit alongside it, talk to the RingSafe team.