A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an origanisation will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# If you would like to report a security issue in private,
# please contact us using the information below.
Contact: <a href='mailto:security@pretix.eu'>security@pretix.eu</a>
Encryption: <a href='https://pretix.eu/.well-known/security@pretix.eu.asc'>https://pretix.eu/.well-known/security@pretix.eu.asc</a>
Acknowledgments: <a href='https://pretix.eu/about/en/security'>https://pretix.eu/about/en/security</a>
Acknowledgments: <a href='https://pretix.eu/about/de/security'>https://pretix.eu/about/de/security</a>
Preferred-Languages: de,en
Canonical: <a href='https://pretix.eu/.well-known/security.txt'>https://pretix.eu/.well-known/security.txt</a>
Policy: <a href='https://pretix.eu/about/en/security'>https://pretix.eu/about/en/security</a>
Policy: <a href='https://pretix.eu/about/de/security'>https://pretix.eu/about/de/security</a>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUUDSPoyJIG0sfIzNsZbNIuVs/QUFAmAUJXAACgkQsZbNIuVs
/QVtTQ/8D1HaKzKZM+0zjfBj/RFoV+OBHiJ8g9XPInbIRsEKKXEgrO4VF8nA3N8t
qKSGVKV0us7dYlWZe4KfoR9dSeZ2h+hP3zAMmVECvbgnJAKzhYj10pirVlCfIxAR
Md9hSY7UYhah9maQcOX35YjhYIFlaqWUiXtWGtFw0Erfmh3DdurK5jDslwfZTshb
K5rvKwWvIOBQnffAb3LjynySaET/asjh/CW8lLco4fIScOlmsYNDjnmnooAD4y8P
36P3wtFBiFUltKdNb4PNA29brlJTWyq71QCwdLl5pk1pyZjVZEfHp7sdopvN3h6U
Q3lzZHlAQ/C18jpaULDD1Dird90MX54nY7cqvA9uriBAF/t9Wj63xwTZqXfsIOYh
IeZKVa2pBPW7bmWA4yh7WD/FwfBffXIBy87EiR/7fzTKZWL1hxw9ROoVrqW+Voew
H3zLThycBN5lazh87SZPgngLvDWLyEqHgGyiYOtIySyTKUyHi3KUxN0SXAWeUsl2
DI1qFatBBylmqsxBVwR0ZA8odQzhn149ZdjrCvAO5xyLzn6Pw/Sb3rNphX0CSH7P
Ub3j9JHI7BamNnwaNAKvrI+gkzKWQ+nxGSWyf8EMag+tJna8KwVy1Ah8A3b3HyCt
0XK55kr0w/urxc+IYM54dsSTq2lQv/ORMMajvyPK13z1l+UxuEE=
=Zkc2
-----END PGP SIGNATURE-----