A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# Canonical URL
Canonical: https://www.filestack.com/.well-known/security.txt

# Our security address
Contact: mailto:security@filestack.com

# Vulnerability Disclosure Policy
Policy: https://www.filestack.com/security/Filestack-Vulnerability_Disclosure_Policy.pdf

# Our OpenPGP key
Encryption: https://www.filestack.com/security/pgp-key.txt
-----BEGIN PGP SIGNATURE-----

iQHLBAEBCgA1FiEETK/nIeuiuzvMdcua1Bihv9yhFdUFAmCAevsXHHNlY3VyaXR5
QGZpbGVzdGFjay5jb20ACgkQ1Bihv9yhFdUAdgwAncbgYaERtQw5oHOVb2nGfYhS
n2LFo6fYbk2yIT/hx/s9mU9VkzWhGA0UNw60pYo3yg+YWwG/ljj/J3DiOa9B2s1M
qTj04rCsMJexQmhcLfMv9Q+I3+fldDk7SQ07nRL9kSOBhlW9fbFvUUS58hyV0PkT
ziC5nnG1bYwVHvCl2nxWDE+Z5M0sTetilY2Zep0fp2QQB3FNnqY2NQK0KYjXiZlT
eJjXbImFN8m8xFtZTQ2iroEan1wBWVH8NURJKQ73vLgrkoSCR6HuULN1AAwxZkfG
n3t3LXapKZ3uZn4YqwyntxYiMiTPjbJ7ZVRidLJRNAAxu+vsilVX2V15ysqY13Ql
BEHorw+xeZxDdoHF4I9MV7rCYashyskefkEdHRCeScEznNBENYkig/U4LB/EBn7R
SyiLNroHV0KoD+SBYVCjbHzsn6b7DM0fnrBZjOOyA5OPF7B7D56oiwXLOal68NlD
XLkUNJoV0PipJ5q89JNjsxEXvTpzEzzLB2W80pWm
=OuWY
-----END PGP SIGNATURE-----