Under the policy, security researchers can report flaws in websites run by the secretary of state, including voter registration and election results.