Understanding Public and Private Bug Bounties and Vulnerability Disclosure Programs

**Executive summary:** This blog post explains the differences between bug bounty programs and vulnerability disclosure programs (VDPs), how incentives and recognition differ, and the considerations for running public versus private programs (including when to start private to manage submission volume or protect sensitive assets). It advises that organizations may run both types with different scopes and highlights regulatory drivers and practical guidance for choosing the appropriate program model.