https://commission.europa.eu/aid-development-cooperation-fun...
Also companies have emerged for providing secure platforms for whistleblowers.
Though, as national security and related things are in the hands of the member states, I am not sure how well this EU law and its national adaptations apply to the cases discussed in this article (probably wholesale exemptions have been adopted by the member states at this front).
EDIT #1: At some point they also tried to draft a law for protecting people involved in vulnerability disclosure, which would have been great, but I think this lawmaking proposal failed.
EDIT #2: I should have read the article better; it seems similar laws exist also in the US.