Security questionnaire answers › Infrastructure
Do you have a vulnerability disclosure or bug bounty program? How to answer it in a security questionnaire
Why buyers ask this
A clear channel for researchers helps weaknesses reach you before attackers exploit them.
What a strong answer includes
- Point to a security.txt or disclosure page with contact and scope.
- State response targets, such as acknowledgment within 3 business days.
- Say whether you pay rewards or offer safe-harbor language.
Sample answer to adapt
Replace the bracketed parts with your own facts. Only state what is true for your environment.
Yes. We publish a vulnerability disclosure policy at [URL] and a security.txt file. Reports go to [security@domain], are acknowledged within [3 business days], and we do not pursue good-faith researchers who follow the policy. [We offer rewards at our discretion.]
Evidence to attach
- Disclosure policy page
- security.txt
Common mistakes
- A policy page with an unmonitored inbox.
Answer questionnaires from your own documents
Korrali Trust drafts answers from your policies and evidence so every response traces back to its source, and a person reviews it before it goes out.