Intake
Researchers submit a structured request with vendor, product, attack surface, evidence, disclosure timing, and a preliminary CVSS assessment.
Researcher-to-vendor disclosure platform
VAPT connects researchers and security teams with vendors through coordinated disclosure.
The platform combines structured vulnerability intake, private case coordination, public advisories, and CVE support when a case should receive an identifier. Pentest firms and independent researchers gain recognition, vendors get a faster path to remediation, and VAPT keeps the disclosure record coherent from intake to publication.
Public advisories--
Stable disclosure URLs and machine-readable CVE references.
Queued disclosures--
Private intake records awaiting triage or publication.
CVE supportLive
Identifier handling is available when a coordinated case should receive one.
Mission flow
How VAPT turns a report into a public advisory.
Assessment
VAPT case teams validate scope, reproduce impact, check for duplicates, and coordinate directly with vendors on remediation and publication timing.
Publication
Public advisories publish with stable identifiers, remediation guidance, metrics, and schema-backed CVE record data.
Program pillars
Built for disclosure operations.
Public advisory location
Stable detail pages, severity telemetry, remediation state.
Each advisory has a canonical URL, structured metadata, and the technical depth needed for downstream reference and scraping.
Coordinated intake
Analyst-grade request capture with evidence and scoring.
The intake form captures attack context, affected components, MITRE and CWE mapping, verification flags, and disclosure notes.
CVE support
Identifier handling when a coordinated case should receive one.
The backend keeps CVE Services authentication, reserve and publish actions, and record construction on the server side when VAPT needs to support the disclosure with a CVE record.
Latest advisories
Advisory feed preview.
Loading advisory preview.
Fetching the latest published disclosure records for the homepage feed.
Loading advisory preview.
Fetching the latest published disclosure records for the homepage feed.