Singapore GovTech VDP
By Government Technology Agency (GovTech) Vulnerability disclosure program on Self-hosted tech.gov.sg
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 1
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report as the policy says
- The policy page explains how.
- Replies within 3 days
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
Provide you with any cash reward or financial incentive of any kind for the detection and/or resolution of the validated vulnerability
- Response
-
Within 3 days
Acknowledge receipt of your suspected vulnerability report and notify the Stakeholders of the suspected vulnerability within 3 business days from our receipt of your report
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
1 asset you may test.
Products and areas 1
- government internet-accessible applications
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Singapore GovTech VDP's policy.
While testing
-
Act responsibly for the sole purpose of reporting suspected vulnerabilities and safeguarding users from damage, harm or loss
-
Avoid causing any kind of damage, harm or loss to individuals or organisations
-
Under no circumstances should you attempt to exfiltrate any computer data or publish details of any suspected vulnerability
-
Deploy destructive, disruptive or other unlawful means to detect vulnerabilities (e.g., attacks on physical security, social engineering, denial of service, brute force attacks)
-
Exploit, test or otherwise use any suspected vulnerability
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.