Independent security researchers have found flaws in a company's public web application, but they are unsure how to report them and fear legal action if they do. Which policy should the company publish to address this?

A vulnerability disclosure policy tells external parties how to report security weaknesses they discover, what is in scope, how the organization will acknowledge and communicate about reports, expected timelines, and safe-harbor terms stating that good-faith research within the rules will not be pursued legally. Publishing one encourages responsible disclosure instead of silence or public release and gives the security team a structured intake channel. It may be paired with a bug bounty program, but the policy itself is the governing artifact. A privacy policy explains what personal information the organization collects, how it is used, and what rights individuals have; it does not establish a reporting channel or legal protections for researchers. An incident response policy defines internal authority, roles, and obligations for handling security incidents; a reported vulnerability may eventually feed into that process, but the policy does not invite or protect outside reporters. An acceptable use policy governs how employees and authorized users may use organizational systems, so it does not apply to independent researchers. Exam caveat: disclosure policies typically define scope boundaries, so testing outside them is not covered by safe harbor. Operational check: publish the policy at a predictable location, route reports to a monitored mailbox, and track acknowledgment and remediation times for each submission.