A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# Canonical URI
Canonical: https://return-path.dk/.well-known/security.txt
# Our security address
Contact: mailto:security@return-path.dk
# Our OpenPGP key
Encryption: https://return-path.dk/.well-known/public.asc
# Our security policy
Policy: https://return-path.dk/security_policy.html
# Preferred languages for security reports
Preferred-Languages: en, da, se
# Acknowledgments/Hall-of-Fame
Acknowledgments: https://return-path.dk/hall-of-fame
# Permissions Policy
Permissions: https://return-path.dk/permissions-policy.html
# Expiry date for this file
Expires: 2026-12-31T18:37:07Z

-----BEGIN PGP SIGNATURE-----

iI0EARYKADUWIQQohbXyvoItrDpv5QzUlx0DmdtbIgUCZR6wJxccbWljaGFlbEBy
ZXR1cm4tcGF0aC5kawAKCRDUlx0DmdtbIi6cAP0RRnKD06CXlkZZ0UOPWmuynkPF
3zNjt6fESz5wtf9U4gEAo3n/ekJjGeaOPtMyET0JrZPi03+etWojlxMjj5BALwY=
=jhmq
-----END PGP SIGNATURE-----