A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:kwaliteitsteam@acato.nl
Expires: 2026-02-12T07:00:00.000Z
Preferred-Languages: en,nl
Policy: https://acato.nl/certificeringen/
Encryption: https://acato.nl/.well-known/public.pgp
Canonical: https://acato.nl/.well-known/security.txt
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEpInEwDS73TngSf5VCPAKUChrxW4FAmfIEAMACgkQCPAKUChr
xW7MqhAAuviEFUWZoz1TfolngtnczzR80XUDCCH3kpUVzdjqcG7hep2BQ0nyGSNO
0mi4Grkzt2ngqN06OwiGJzB587BPSEqZ1eArDCwLu0v+MgBI5LIKma0elACgEGK7
a4y6u6C2Ch9AJQJZbrr/GwjJUlPj4GHu0GZ/Dou2xrHn6VzSxPx1+zwpavl776h+
pX46Yf8d56pATnAMH1c2jiNjvUrTIx5h8dHWtjgvZCpPQ/kp1zB4Lal8L0+IdX75
pWBEGVFznYdA7XDo/ERAiYeLXf6wBOsFwti2a24NGKtpww8HV8VepcUjPJwtwRx5
RFjikUZ1b/kuuFaHrt2HJwo4iUpJCFPupICa0Qa/hWbBvnB97cKnRLbIkluMeZ2x
ma3tdfwGupTYQKb3UCznm4H4r4YoRypaeKBx9D0kxIEZlHjrzRYtFB17gZ08DJAu
8g5xHeFBWdkb3Jv9h2AAOAFfym6Mn1rX+cLENPDdjS3rAcjXpNa5kGU8KY6fibxb
Z5JyrTZDTrJWTpy4pPCUmYRbyBcT1SkwcgMTLKwhW/HX2LyWMvZtQ6EdhAdrn/CH
oPUZjgnKxCZ7PJJRgUuhZFQQbJUNctQ7VcBW5TlYq2ZcWhF8EOTjmsAkJ+VSBFWX
jtAp7afUzuqDdlKkNJerGcZNj3y5SiL65WLQO48XSyPiuTVZa3Q=
=mEgP
-----END PGP SIGNATURE-----