Within a year of signing, publish a VDP that authorises public testing of the manufacturer's products, promises the manufacturer will neither take nor encourage legal action against researchers acting in good faith under it, provides a clear reporting channel and allows public disclosure in line with coordinated vulnerability disclosure practice and international standards. Progress may be shown by the published policy, a machine-readable description such as security.txt, and posts on lessons learned.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.