A Vulnerability Reward Program (VRP) is a structured payout system that rewards security researchers for responsibly reporting flaws to a vendor before those flaws are publicly weaponized. In practice, a program defines what kinds of bugs qualify, how reports are verified, and how payments scale with severity, exploitability, and impact.
VRPs matter because they create a legal, controlled route for disclosure. Instead of selling a finding or keeping it secret, a researcher can submit proof of concept details and help the vendor patch the issue. In browser security, for example, a high-value reward may go to a full exploit chain that escapes a sandbox or crosses a privilege boundary. Defenders use VRPs to surface weaknesses earlier, reduce attacker advantage, and encourage careful, documented research rather than silent exploitation.