...

https://www.ntia.doc.gov/files/ntia/publications/ntia_vuln_disclosure_early_stage_template.pdf

Disclose.io

disclose.io is a cross-industry, vendor-agnostic standardization project for safe harbor† best practices to enable good-faith security research.

Main web site: https://disclose.io/

Github repository with policy templates: https://github.com/disclose/disclose

Open Source Vulnerability Disclosure Framework

...

https://github.com/bugcrowd/disclosure-policy

Security.txt

security.txt: A proposed standard which allows websites to define security policies.

https://securitytxt.org/ and IETF draft https://tools.ietf.org/html/draft-foudil-securitytxt-08

U.S. GSA Vulnerability Disclosure Policy

...

https://www.justice.gov/criminal-ccips/ccips-documents-and-reports

Disclose.io

disclose.io is a cross-industry, vendor-agnostic standardization project for safe harbor† best practices to enable good-faith security research.

Main web site: https://disclose.io/

Github repository with policy templates: https://github.com/disclose/disclose

Where to Look for More

Numerous organizations have already posted their vulnerability disclosure policies. A wide variety of these policies can be found by searching the web for "vulnerability disclosure policy," or "vulnerability disclosure program," or by browsing third-party vulnerability disclosure (e.g., bug bounty) service providers' hosted programs.  

...