How Federal Agencies Use Vulnerability Disclosure Policies to Level Up Security

**Executive Summary:** This document advocates for government adoption of vulnerability disclosure policies (VDPs), highlights HackerOne's role in early U.S. government programs like Hack the Pentagon, and recommends low-cost steps and five essential VDP components (promise, scope, safe harbor, process, preferences) to help agencies accept and manage vulnerability reports.