# VDP planning worksheet

## Authority and scope

- Who can approve the program and its commitments?
- Which domains, applications, APIs, products, and versions are covered?
- Which services are excluded, and why?
- Which supplier permissions or contracts need review?
- Who updates scope when services change?

## Research conditions

- Which methods and account types are permitted?
- Which disruptive or sensitive activities are excluded?
- What should a researcher do after unexpected access to sensitive information?
- How can a researcher ask about an unclear boundary before testing?
- Who reviews authorization and safe-harbor language?
- Which commitments are outside the organization's authority?

## Report intake

- What is the actual reporting channel?
- Who monitors it, including during absence?
- How can sensitive evidence be transmitted?
- Which minimum fields make a report investigable?
- How are attachments isolated and reviewed?
- Who can access reports, and how long are they retained?
- When was the reporting route last tested end to end?

## Triage and repair

- Who acknowledges receipt?
- Who verifies scope and reproduces behavior?
- Who assigns the affected service owner?
- Which conditions trigger incident response?
- How are duplicates, rejected claims, and new evidence handled?
- What proves the fix works?
- Who can accept risk, with which review date?

## Communication and disclosure

- What acknowledgement and update commitments can staffing support?
- Who communicates with the reporter?
- How will delays and unresolved questions be explained?
- Which suppliers, customers, or coordinators may need to participate?
- Who decides on advisories, timing, and researcher credit?
- How are decisions and earlier policy versions preserved?

## Publication and maintenance

- Where will the final approved policy be published?
- Who maintains contact information and any security.txt expiry?
- Which cases will be sampled to check closure quality?
- Who owns the next program review, and when is it due?