
U.S. Dept Of Defense
External Program
Submit bugs directly to this organization


External Program
Submit bugs directly to this organization
This expanded program is intended to give security researchers terms and conditions for conducting vulnerability discovery activities directed at publicly accessible Department of Defense (DoD) information systems¹, including web properties, and submitting discovered vulnerabilities to DoD. If questions arise, please take no action until that action is discussed with the VDP lead at the Department of Defense Cyber Crime Center (DC3).
##Overview Maintaining the security of our networks is a high priority at DoD. Our information technologies provide critical services to Service Members, their families, and DoD employees and contractors. Ultimately, our network security ensures that DoD can defend the United States of America. Recognizing that the broader security research community regularly makes valuable contributions to the security of the Internet, DoD believes that a close relationship with this community will also improve our security. As a result, if you have information about a vulnerability, we want to hear from you!
First, any information submitted to the DoD under this program will be used for defensive purposes – to mitigate or remediate vulnerabilities in our networks or applications, or in the applications of our vendors. This research is not contributing to offensive tools or capabilities.
Second, the VDP program is part of DoD’s efforts to host a conversation between outside security researchers and the Department. This discussion is already underway and as of September 2020, security researchers have identified more than 24,000 potential exploits for our public facing systems. This new program broadens this exchange by offering additional terms and conditions on publicly accessible information system and reporting vulnerabilities – all as part of the effort to improve security over time.
Please review program terms and conditions carefully. Before participating in the VDP, conducting any testing of DoD networks Band prior to submitting a report, you must agree to abide by these new terms and conditions. Failure to abide by the terms and conditions will result in the loss of being considered a security researcher under the program.
Publicly accessible information systems, web property, or data owned, operated, or controlled by DoD.
Please provide a detailed summary of the vulnerability including: type of issue; product, version, and configuration of software containing the bug; step-by-step instructions to reproduce the issue; proof-of-concept; impact of the issue; and suggested mitigation or remediation actions, as appropriate.
By clicking “Submit Report,” you are indicating that you have read, understand, and agree to the terms and conditions of the program for the conduct of security research and disclosure of vulnerabilities or indicators of vulnerabilities related to publicly accessible DoD information systems, and that you consent to having the contents of the communication and follow-up communications stored on a U.S. Government information system.
DoD will deal in good faith with security researchers who discover, test, and submit vulnerabilities² or indicators of vulnerabilities in accordance with these terms and conditions:
We take every disclosure seriously. We will investigate every disclosure and strive to ensure that appropriate steps are taken to mitigate risk and remediate all reported vulnerabilities.
DoD has a unique information and communications technology footprint. Many DoD technologies are deployed in combat zones and support ongoing military operations. This means that DoD systems can have a life-or-death impact on Service Members and partners of the United States. This also means that it may take longer than you expect to remediate some vulnerabilities as the DoD must take extra care while working with these systems.
DoD remains committed to coordinating with the security researcher transparently and promptly. This includes taking the following actions:
This policy does not grant authorization, permission, or otherwise allow express or implied access to DoD information systems to any individual, group of individuals, consortium, partnership, or any other business or legal entity. However, if a security researcher working in accordance with the terms and conditions of this VDP program discloses a vulnerability, then: (1) DoD will, in the exercise of its authorities, take the following steps to: (1) not initiate or recommend any law enforcement action or civil lawsuits related to such activities against that researcher, and (2) Inform the pertinent law enforcement agencies or civil plaintiffs that the researchers activities were, to the best of our knowledge, conducted pursuant to, and in compliance, with the terms and conditions of the program.
You must otherwise comply with all applicable Federal, State, and local laws in connection with your security research activities. You may not engage in any security research or vulnerability disclosure activity that is inconsistent with terms and conditions of the program or the law. If you engage in any activities that are inconsistent with the terms and conditions of the program or the law, you will not be considered a security researcher and may be subject to criminal penalties and civil liability.
To the extent that any security research or vulnerability disclosure activity involves the networks, systems, information, applications, products, or services of a non-DoD entity (e.g., other Federal departments or agencies; State, local, or tribal governments; private sector companies or persons; employees or personnel of any such entities; or any other such third party), that non-DoD entity may independently determine whether to pursue legal action or remedies related to such activities.
DoD may modify the terms and conditions or terminate the program at any time.
¹ DoD interprets the term “publicly accessible” as the means of accessing “Information systems,” as defined by 6 U.S.C. 1501(9) and 44 U.S.C. 3502, whereby a researcher has complied with all stated limitations of activity under the guidelines of the VDP policy. ² “Vulnerabilities” throughout this policy may be considered “security vulnerabilities” as defined by 6 U.S.C. 1501(17). ³ These activities, if applied consistent with the terms of this policy, constitute “defensive measures” as defined by 6 U.S.C. 1501(7).