A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:security@startmail.com
Encryption: https://www.startmail.com/.well-known/security@startmail.com.pgp-key.txt
Encryption: openpgp4fpr:D7A1898F41A45AE3F213AF811BFAD38900DCC223
Preferred-Languages: en, nl, de
Canonical: https://www.startmail.com/.well-known/security.txt
Expires: 2024-10-10T10:10:10z
-----BEGIN PGP SIGNATURE-----

iQJLBAEBCAA1FiEEarh+hMueXE3XKf+l6UX8pv4qDRAFAmVfVkUXHHNlY3VyaXR5
QHN0YXJ0bWFpbC5jb20ACgkQ6UX8pv4qDRAQ3xAA1yPfca25/V264NQVFI9aLkEx
LgvHWPsjOcp4YusZOZ7sel42cLF9ZmacvRbL5HolPBnos/Lnp6uieowgzNoui/N3
sN+ry1sTsQBasvvjMYsPA4R9MxnkWTfwfYhWCqvubpdYeVUDI1dGIIfRgWGPwIu/
QBXLpQJ5QVD/5Qxfz1y3tKIZoPCdfJ5NZOzbU8lw4rMiC0fR74xgDKqc8I1VHQbg
/HeENJIZQVA7FaQDzEY0ruEvKRfH1LN3n265s2aKpR0QB1tQQ11f48i8U359w3zb
GdHFUTicY/JyFgNK54wSC0FW0sG0pLd9DwZkPMwVo0MEa7Bco9AeJSpEGWJ9NXAS
EaWTDZ1rRt04kbnIBrONIbDmbxd/gc3azLbTBWtyBW2ady0Um6cjTxitA9MuRb1Z
vHJWwRQlFfe4USLMmygurvMNq7GlDN2+Re8MEjLv9xRZX4qGrxQOlZad7lXAgK4b
H0fTDeoZl+XqvClqQhNRyNlJ1MoFke19MhpDa2FTYRSXmxaemzMfd3JfAEUI9WP0
nt04wjAOMfNeQ4e2kay9HcyYPI21b02V0ysLV2zvYv/VZWxONEmbmuiKvZk2gssr
bK7WcSWo/0WpxV0Q6trNnGAZJVP72JaDL0h9eER8EVrjGofWNSbVFnot47Gwt+7z
d5aE3ZNd9Gcv/A05llk=
=mS1i
-----END PGP SIGNATURE-----