Coordinated Vulnerability Disclosure
Always open for the heads-up
Anyone can come across a security issue in your systems. The question is simple: when they do, is there a safe way to tell you?
Coordinated Vulnerability Disclosure
Always open for the heads-up
Anyone can come across a security issue in your systems. The question is simple: when they do, is there a safe way to tell you?
Coordinated Vulnerability Disclosure
Always open for the heads-up
Anyone can come across a security issue in your systems. The question is simple: when they do, is there a safe way to tell you?
Coordinated Vulnerability Disclosure
Always open for the heads-up
Anyone can come across a security issue in your systems. The question is simple: when they do, is there a safe way to tell you?
What is CVD
Simple way to receive vulnerability reports from the outside world
Coordinated Vulnerability Disclosure (CVD) is a policy, which gives anyone outside your organisation a safe way to report a potential vulnerability they come across in your system. It tells them how to report it, what the rules are, and what happens next.
Sometimes someone spots a security issue before your team does. Without a clear reporting route, that message can end up with the wrong person, go unread, or never reach you at all.
With Zerocopter, you get a policy adapted to your organisation and a secure reporting page. Every report comes to us first. Our specialists validate it, clarify what is needed with the reporter, and send your team only the findings that require your attention and action.
CVD PROGRAM
All you need for safe vulnerability reporting.
Tell us what you need. A specialist will help define the scope and next steps.
Included
Reporting template · Clear disclosure policy · Unlimited submissions · Report validation · Reporter communication · Remediation guidance
Choose a time directly in our calendar.
What is CVD
Simple way to receive vulnerability reports from the outside world
Coordinated Vulnerability Disclosure (CVD) is a policy, which gives anyone outside your organisation a safe way to report a potential vulnerability they come across in your system. It tells them how to report it, what the rules are, and what happens next.
Sometimes someone spots a security issue before your team does. Without a clear reporting route, that message can end up with the wrong person, go unread, or never reach you at all.
With Zerocopter, you get a policy adapted to your organisation and a secure reporting page. Every report comes to us first. Our specialists validate it, clarify what is needed with the reporter, and send your team only the findings that require your attention and action.
CVD PROGRAM
All you need for safe vulnerability reporting.
Tell us what you need. A specialist will help define the scope and next steps.
Included
Reporting template · Clear disclosure policy · Unlimited submissions · Report validation · Reporter communication · Remediation guidance
Choose a time directly in our calendar.
What is CVD
Simple way to receive vulnerability reports from the outside world
Coordinated Vulnerability Disclosure (CVD) is a policy, which gives anyone outside your organisation a safe way to report a potential vulnerability they come across in your system. It tells them how to report it, what the rules are, and what happens next.
Sometimes someone spots a security issue before your team does. Without a clear reporting route, that message can end up with the wrong person, go unread, or never reach you at all.
With Zerocopter, you get a policy adapted to your organisation and a secure reporting page. Every report comes to us first. Our specialists validate it, clarify what is needed with the reporter, and send your team only the findings that require your attention and action.
CVD PROGRAM
All you need for safe vulnerability reporting.
Tell us what you need. A specialist will help define the scope and next steps.
Included
Reporting template · Clear disclosure policy · Unlimited submissions · Report validation · Reporter communication · Remediation guidance
Choose a time directly in our calendar.
What is CVD
Simple way to receive vulnerability reports from the outside world
Coordinated Vulnerability Disclosure (CVD) is a policy, which gives anyone outside your organisation a safe way to report a potential vulnerability they come across in your system. It tells them how to report it, what the rules are, and what happens next.
Sometimes someone spots a security issue before your team does. Without a clear reporting route, that message can end up with the wrong person, go unread, or never reach you at all.
With Zerocopter, you get a policy adapted to your organisation and a secure reporting page. Every report comes to us first. Our specialists validate it, clarify what is needed with the reporter, and send your team only the findings that require your attention and action.
CVD PROGRAM
All you need for safe vulnerability reporting.
Tell us what you need. A specialist will help define the scope and next steps.
Included
Reporting template · Clear disclosure policy · Unlimited submissions · Report validation · Reporter communication · Remediation guidance
Choose a time directly in our calendar.
What can it do
Make your reporting channel your own
Configure your reporting form, use our standard text or write your own. Adjust the settings that matter to your organization without a complicated setup.
·
Customize the reporting form to fit your organization
·
Use Zerocopter’s standard text or write your own
·
Keep the process consistent with your internal setup
What can it do
Make your reporting channel your own
Configure your reporting form, use our standard text or write your own. Adjust the settings that matter to your organization without a complicated setup.
·
Customize the reporting form to fit your organization
·
Use Zerocopter’s standard text or write your own
·
Keep the process consistent with your internal setup
What can it do
Make your reporting channel your own
Configure your reporting form, use our standard text or write your own. Adjust the settings that matter to your organization without a complicated setup.
·
Customize the reporting form to fit your organization
·
Use Zerocopter’s standard text or write your own
·
Keep the process consistent with your internal setup
What can it do
Make your reporting channel your own
Configure your reporting form, use our standard text or write your own. Adjust the settings that matter to your organization without a complicated setup.
·
Customize the reporting form to fit your organization
·
Use Zerocopter’s standard text or write your own
·
Keep the process consistent with your internal setup
01
Your reporting page goes live
We provide you with a ready-to-publish policy page and reporting form for your website with clear disclosure rules.
02
We handle every report first
We receive every incoming report, communicate with the reporter, filter them, and validate what actually needs attention.
03
You get the next steps
Your team receives only valid vulnerability reports, with the relevant context and clear advice on what to do next.
01
Your reporting page goes live
We provide you with a ready-to-publish policy page and reporting form for your website with clear disclosure rules.
02
We handle every report first
We receive every incoming report, communicate with the reporter, filter them, and validate what actually needs attention.
03
You get the next steps
Your team receives only valid vulnerability reports, with the relevant context and clear advice on what to do next.
01
Your reporting page goes live
We provide you with a ready-to-publish policy page and reporting form for your website with clear disclosure rules.
02
We handle every report first
We receive every incoming report, communicate with the reporter, filter them, and validate what actually needs attention.
03
You get the next steps
Your team receives only valid vulnerability reports, with the relevant context and clear advice on what to do next.
01
Your reporting page goes live
We provide you with a ready-to-publish policy page and reporting form for your website with clear disclosure rules.
02
We handle every report first
We receive every incoming report, communicate with the reporter, filter them, and validate what actually needs attention.
03
You get the next steps
Your team receives only valid vulnerability reports, with the relevant context and clear advice on what to do next.
Frequently asked
Your questions answered
Can anyone use the CVD reporting page?
Yes. The public policy gives anyone who comes across a potential vulnerability a safe, clear way to report it. The policy covers all assets of your organisation, excludes third-party systems and sets out what behaviour your organisation expects from reporters. It provides safe harbour for good-faith reporting and does not invite active testing.
What happens to reports that are out of scope?
Zerocopter reviews each report against the policy scope. Reports on third-party systems, or on issues the policy does not cover, fall out of scope. Zerocopter informs the reporter and, where possible, helps the reporter find the right place to report the issue, so the report still reaches a party that can act on it.
How does Zerocopter handle confidentiality?
Zerocopter treats every report as confidential. Only Zerocopter and the nominated contacts at your organisation see the report details. The policy asks reporters not to disclose a vulnerability publicly until your organisation has had the opportunity to resolve it.
Frequently asked
Your questions answered
Can anyone use the CVD reporting page?
Yes. The public policy gives anyone who comes across a potential vulnerability a safe, clear way to report it. The policy covers all assets of your organisation, excludes third-party systems and sets out what behaviour your organisation expects from reporters. It provides safe harbour for good-faith reporting and does not invite active testing.
What happens to reports that are out of scope?
Zerocopter reviews each report against the policy scope. Reports on third-party systems, or on issues the policy does not cover, fall out of scope. Zerocopter informs the reporter and, where possible, helps the reporter find the right place to report the issue, so the report still reaches a party that can act on it.
How does Zerocopter handle confidentiality?
Zerocopter treats every report as confidential. Only Zerocopter and the nominated contacts at your organisation see the report details. The policy asks reporters not to disclose a vulnerability publicly until your organisation has had the opportunity to resolve it.
Frequently asked
Your questions answered
Can anyone use the CVD reporting page?
Yes. The public policy gives anyone who comes across a potential vulnerability a safe, clear way to report it. The policy covers all assets of your organisation, excludes third-party systems and sets out what behaviour your organisation expects from reporters. It provides safe harbour for good-faith reporting and does not invite active testing.
What happens to reports that are out of scope?
Zerocopter reviews each report against the policy scope. Reports on third-party systems, or on issues the policy does not cover, fall out of scope. Zerocopter informs the reporter and, where possible, helps the reporter find the right place to report the issue, so the report still reaches a party that can act on it.
How does Zerocopter handle confidentiality?
Zerocopter treats every report as confidential. Only Zerocopter and the nominated contacts at your organisation see the report details. The policy asks reporters not to disclose a vulnerability publicly until your organisation has had the opportunity to resolve it.
Frequently asked
Your questions answered
Can anyone use the CVD reporting page?
Yes. The public policy gives anyone who comes across a potential vulnerability a safe, clear way to report it. The policy covers all assets of your organisation, excludes third-party systems and sets out what behaviour your organisation expects from reporters. It provides safe harbour for good-faith reporting and does not invite active testing.
What happens to reports that are out of scope?
Zerocopter reviews each report against the policy scope. Reports on third-party systems, or on issues the policy does not cover, fall out of scope. Zerocopter informs the reporter and, where possible, helps the reporter find the right place to report the issue, so the report still reaches a party that can act on it.
How does Zerocopter handle confidentiality?
Zerocopter treats every report as confidential. Only Zerocopter and the nominated contacts at your organisation see the report details. The policy asks reporters not to disclose a vulnerability publicly until your organisation has had the opportunity to resolve it.
READY, SET, ...
How to get started
From tailoring the policy to handling the first report, here’s what to expect.
01 · Create an account
Set up your Zerocopter account and nominate the people who should receive validated findings.
02 · Tailor the policy
Agree on the reporting rules and response process for your organisation.
03 · Publish the reporting page
Add the disclosure policy and secure reporting route to your website.
04 · Let us handle the reports
We communicate with reporters, validate submissions and send your team the findings that require action.
READY, SET, ...
How to get started
From tailoring the policy to handling the first report, here’s what to expect.
01 · Create an account
Set up your Zerocopter account and nominate the people who should receive validated findings.
02 · Tailor the policy
Agree on the reporting rules and response process for your organisation.
03 · Publish the reporting page
Add the disclosure policy and secure reporting route to your website.
04 · Let us handle the reports
We communicate with reporters, validate submissions and send your team the findings that require action.
READY, SET, ...
How to get started
From tailoring the policy to handling the first report, here’s what to expect.
01 · Create an account
Set up your Zerocopter account and nominate the people who should receive validated findings.
02 · Tailor the policy
Agree on the reporting rules and response process for your organisation.
03 · Publish the reporting page
Add the disclosure policy and secure reporting route to your website.
04 · Let us handle the reports
We communicate with reporters, validate submissions and send your team the findings that require action.
READY, SET, ...
How to get started
From tailoring the policy to handling the first report, here’s what to expect.
01 · Create an account
Set up your Zerocopter account and nominate the people who should receive validated findings.
02 · Tailor the policy
Agree on the reporting rules and response process for your organisation.
03 · Publish the reporting page
Add the disclosure policy and secure reporting route to your website.
04 · Let us handle the reports
We communicate with reporters, validate submissions and send your team the findings that require action.
YOUR NEXT STEP
Make vulnerability reporting work for you
Give researchers a clear way to report vulnerabilities. Talk to Gertjan about your disclosure policy, report handling and the right CVD setup for your organisation.
Gertjan Vaessen
Message us on Whatsapp
YOUR NEXT STEP
Make vulnerability reporting work for you
Give researchers a clear way to report vulnerabilities. Talk to Gertjan about your disclosure policy, report handling and the right CVD setup for your organisation.
Gertjan Vaessen
Message us on Whatsapp
YOUR NEXT STEP
Make vulnerability reporting work for you
Give researchers a clear way to report vulnerabilities. Talk to Gertjan about your disclosure policy, report handling and the right CVD setup for your organisation.
Gertjan Vaessen
Message us on Whatsapp
YOUR NEXT STEP
Make vulnerability reporting work for you
Give researchers a clear way to report vulnerabilities. Talk to Gertjan about your disclosure policy, report handling and the right CVD setup for your organisation.
Gertjan Vaessen
Message us on Whatsapp
Copyright © 2026 Zerocopter BV
Copyright © 2026 Zerocopter BV
Copyright © 2026 Zerocopter BV