A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:csirt@apnic.net
Encryption: https://www.apnic.net/community/security/vulnerability-reporting-gpg-key/
Policy: https://www.apnic.net/community/security/apnic-vulnerability-reporting-program/
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEceE3CgUgM0tUBIra9ci/22BvhFcFAl8XaBoACgkQ9ci/22Bv
hFdE4xAAhDUK0cZllcPDKkpQIMkC3ZRju8ZhYtC5WZFm8LxYE138Y4w1L1vqOUVq
v44oAAi7cab5bBZGtONA1CPcM1nEA8t+Aq41oKCBsizDSZ6C1nTtAvEzlD8bix8y
m2cJrEJCa6XM9ALYa//YYJJuD1ZAz31gKT9jU/dAq5p0dPuLzAVnfBJ6wL3eiKWE
ACYTzM9sXtuuvCLwTX3yX7WX0BTciCvc0CEq5acGzPTlzUKyRbzTKvLfIPSH1A8R
lS0ZgbhyCUHbo0KlkPUce3p9r3XXcwKA0WSEgmad1JIpjCOrkGMVk/QUYaDnW/6t
+sRj+QiMD4DIbWugFtIQXWc6q6ppt/5gTqe8PQS3Ic7Z7gI975QEbbnqHIG+AgJA
gKAp60UduWzNqlFj12lzyIR72F/DMRX+H85YjT6e06SZwusnIFuFXAc/nZj8ApiQ
hALdey/dRVSoO/9etGg1yz9TS5T7ww/5QYcXIaQKG6lLkK9a/U1+DVAs5xG5+G3G
SzWHM0KVBbFJlIoWH+g2d1P0cU2LZgHb+kFrToLOJb0KJn3Kb4h2P9YLvL10ufDA
0xifD6cwP3sPp+IU6Lj7iELoxGuN5fXT6a1pRDJFU8yuxWd7dDnAzxBhGkkp6nDu
0/4PFufIocpN1TJgKzh/lr8CsccSZFnev/xoQQ2eT1Mb3oTVFDA=
=ch51
-----END PGP SIGNATURE-----