A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:security@xpd.se
Preferred-Languages: en,sv
Encryption: https://pgp.circl.lu/pks/lookup?op=get&search=0x7E3B60FA00ED4F64
Encryption: https://pgp.circl.lu/pks/lookup?op=get&search=0xF786C2A13682938B
Policy: https://xpd.se/advisories/xpd-disclosure-policy-01.txt
Canonical: https://xpd.se/.well-known/security.txt
Expires: 2024-02-05T18:47:07.559Z
-----BEGIN PGP SIGNATURE-----

iQJDBAEBCAAtFiEEK2zTgGc/i8BgtMwgfjtg+gDtT2QFAmPf/ZwPHGZyZWRyaWtA
eHBkLnNlAAoJEH47YPoA7U9kZwUP/18eUkF2pQuI4o/F8QbhKyJ5BVnv1HWnYuOS
Xt42eEtJnW46zqYrv2b4g+dIZOU12Achg2RX0uVhE1GQriR+91cBrRzQfT0msk06
s9L4w8vifzMnjXitVMbw+wrwbquqcV7/XlXfm6gvExVC3hcVCvnRyOS04vcxQFui
tFPkl7NQyDyV7qSPDysVRHJXBqImqIjoCHk2McYKkQ6vAeXYIE7GY9Zp8SKQvKYv
TD15G4K+TxmV0zHw/K12wDIUrHKpRMdGXAng/xR70LTzmlFQCa2b9870zBMIHyhf
uiS8QymYHiA0TJpdD/2XKubbXQTfFUxC+ao7NkbyjyhgOoaxqRpNrvWlpH2caPAy
a8xWjBIRkWriYqT3nOxD3gFxF1n7NxW8/Z/IOk/D69JqDX5T2QyaR+F8SOeX96ID
9MXdMpDZP9Jjnr4Krd2T3KFLuksNvLXLvHjJyz6f5vPTUByZh1IfqtaY2QQiNUSY
oZTHGnAzntX1XvEDNMreN/ledVAIdCxChwB0S6Gh3IUZjAjRpW744Tu3TPNDofRS
bSjfeG9niudacS72gV2OJ/z0/yOghBc4auBFLvrooJ3+Ozj72v3fulm6o7GZVbgP
DGKb3cxZaY4wivMeUIoXpWw3gMp9bCXfNeqalIz5mWiX9DlaDk1xegMsgu65VZ2V
Aez12BfN
=6xxR
-----END PGP SIGNATURE-----