A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: security@liferay.com
Encryption: https://www.liferay.com/.well-known/pgp-key.txt
Acknowledgments: https://portal.liferay.dev/people/hall-of-fame/top-contributors
Preferred-Languages: en
Canonical: https://www.liferay.com/.well-known/security.txt
Policy: https://www.liferay.com/security-statement
-----BEGIN PGP SIGNATURE-----

iQFJBAEBCAAzFiEEkyWmm2ge76falBIz0rVz0opHoP8FAl0UOrAVHHNlY3VyaXR5
QGxpZmVyYXkuY29tAAoJENK1c9KKR6D/SHMH/1t9bTG+IEHagTzKygODTe05GTeY
/Q1UlA+UFKHKBDtrlPCmS5HWqmYQrl0R7kX0QE/6kynQnt0A7tpkXzyaf8Y1rXDt
LGLBpUQgj4G4HtZycf4JWntX+jIG+uwiJPs/CL7EnuOMdUJHgFgTwClZWu09xFCF
YCBwtMEwm/9a9RxdBkJAs/lLkQhXcouoYjasyIc6uorj559YcEM3Q132BM9MzdrG
ne+ICZKYkxCrMoH68z295TFCnqcmZwx78UfhA7eDAMACLd0yVlPqBnI+sYEonytA
UXt5PJNtapPrQJ1Te+8Pn5lAUxSNWdTur2x/SS0zC0Dq7HH/HFTCBGY0WlY=
=Jbep
-----END PGP SIGNATURE-----