DICT Issues Revised Guidelines on Vulnerability Disclosure, Safe Harbor, and Bounty Program

The Department of Information and Communications Technology (DICT) has issued Department Circular No. HRA-002, series of 2026, prescribing the revised and consolidated guidelines governing the government’s Vulnerability Disclosure Initiative (VDI), Safe Harbor Policy, and Bounty Program. The Circular aims to strengthen cybersecurity measures by encouraging responsible reporting of system vulnerabilities affecting government digital infrastructure.

 

The policy establishes a framework for security researchers and the public to report vulnerabilities in government information systems, while providing safeguards for those who comply with prescribed disclosure procedures.

 

Coverage

 

The Circular institutionalizes the government’s vulnerability disclosure mechanisms, which allow individuals to identify and report security weaknesses in government systems. It outlines procedures for submitting vulnerability reports, standards for responsible disclosure, and coordination protocols between reporting parties and concerned government agencies.

 

The issuance also provides a Safe Harbor Policy, which grants protection from legal action to individuals who conduct security testing and report vulnerabilities in good faith and in accordance with the guidelines.

 

In addition, the Circular introduces a Bounty Program that allows the government to grant incentives or recognition to qualified individuals who successfully report validated vulnerabilities that contribute to improving government cybersecurity.

 

Scope and Implementation

 

The guidelines apply to government agencies covered by the Executive Branch and are intended to promote proactive detection and remediation of system vulnerabilities. Agencies are directed to adopt appropriate internal processes for vulnerability management and to coordinate with the DICT in implementing the program.

 

Purpose

 

Through the revised guidelines, the DICT seeks to enhance the security and resilience of government digital systems, promote responsible cybersecurity practices, and foster collaboration between the government and the cybersecurity community.

 

Read the full issuance here.