Experience about Vulnerability Disclosure program

Hello indie hackers

I am wondering if anyone started vulnerability disclosure program for SaaS platforms. Can you share experience?
Do and Don't