Vulnerability Disclosure

For basic disclosure programmes, yes. Fig provides the governance layer - intake, triage, remediation tracking, safe harbour enforcement, and disclosure timeline management. For bug bounty programmes with financial rewards, you may use both.

A rate-limited endpoint (5 requests per IP per hour) accepts anonymous reports and routes them to the correct organisation. Researchers do not need an account. Reports include severity, description, and supporting evidence.

Safe harbour protects researchers who report vulnerabilities in good faith. Fig enforces this through configurable policy controls that define what is in scope, acceptable testing methods, and researcher protections. Exploitation breach detection flags reports that cross the line.

Yes. Disclosed vulnerabilities feed into the same 9-state governance workflow used for scanner findings. Remediation, verification, and closure follow identical governed processes.

ISO 29147 (Vulnerability Disclosure) and ISO 30111 (Vulnerability Handling). The workflow, policy controls, and audit trail are designed to meet these standards out of the box.