CISA Vulnerability Disclosure
Coordinated disclosure into CISA for federal civilian and designated critical-infrastructure systems. Not a cash bounty board.
Tags: vdp, disclosure, federal
- Program model
- Coordinated VDP
- Regions
- US / federal + critical infrastructure
- Payout
- None typical; coordination and credit, not a cash table
Specialties: disclosure, federal, critical-infrastructure
How to approach it
Use this when the asset is government or designated CI and there is no private program. Read current CISA CVD rules before you test.
- Authorization still matters. CVD is not a hunting license on .gov.
- If a vendor program exists, use that first.