A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

# Canonical URL
Canonical: https://holmgrown.com/.well-known/security.txt

# Our security address
Contact: mailto:security@holmgrown.com

# Our OpenPGP key
Encryption: https://holmgrown.com/pgp-key.txt

# Our security policy
Policy: https://holmgrown.com/security-policy.txt

# This file is expected to remain current before
Expires: 2021-12-31T23:59:59Z
-----BEGIN PGP SIGNATURE-----

iQHLBAEBCAA1FiEEc/GAJxwkbA2t4h/5sG4P53nM1QkFAmAhu1UXHHNlY3VyaXR5
QGhvbG1ncm93bi5jb20ACgkQsG4P53nM1QmzGAwA2O30Mv3SBosdxs472d12JooU
V5U7cySwMaD8gMn+z8+dNSze76bxUTWirTiIoW31MCc2hDHyH3Yuwt8/MG/OINSy
lySsVshe2ezVwtBVLw5Y+FOzPQ8SiO4MfuEUiwk86WtUoA0n1T5nPsA3NwgfltEM
Z35pg1Vo9kxVnidtrmeCfIw4Xw3OpPKj8KgTTuu15qgNsZCm1jekPZZKP6X6KjbE
Yo9nWSC2JrcBpUpENnMOicSLp0bzd8aQT4yCLNonuNdARk2TA1HEZV0MSQcLsZQ8
W253MZ5zYqiSY/loGCi/pDFaTOmH4A2Q5kP/v2jN0MvaXEWla5GlZbktuZzNv0rR
msKm2zNOgA/w9Y/6hFUhGuxWKK23sso1nOFrycDxdDIEKzeanB83bbiJ/cqvwxoi
yA0FqFaqQcxmMRf7Qz9lY/7V4lxrd2ocohKKB93RSX1SUBJWc9xbBvBSQFrJEO9b
3DIILtMgyUxoRTQiS76zfNYp0L3aZcCF7I4W80X6
=vMwA
-----END PGP SIGNATURE-----