Safe Harbor & Coordinated Disclosure
BlackShield provides every tenant with a dedicated, self-hosted Vulnerability Disclosure portal at /vdp. Organizations can define in-scope assets, specify disclosure policies, provide official PGP public keys, and offer legal safe harbor to ethical researchers.
Legal Safe Harbor
Clear commitments protecting researchers acting in good faith under CFAA, DMCA, and civil liability standards.
PGP Ingestion Security
Submissions are encrypted with tenant PGP keys before persistence in isolated tenant storage partitions.
Finding Intake Pipeline
Verified reports automatically flow into the main findings inbox and dispatch alerts to Slack and Jira.
Program Management
- Enable VDP portal in Tenant Settings → Vulnerability Disclosure.
- Define in-scope domains and excluded out-of-scope targets (e.g. third-party SaaS, denial-of-service).
- Paste security team PGP public key and designated security contact email.
- Publish the public portal link to
/.well-known/security.txt.