A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

#
# DoIT RFC 9116 security.txt
#
Canonical: https://circl.site/.well-known/security.txt
Canonical: https://www.circl.site/.well-known/security.txt
Canonical: https://mail.circl.site/.well-known/security.txt
Canonical: https://ionos.circl.site/.well-known/security.txt
Canonical: https://mx1.circl.site/.well-known/security.txt
Canonical: https://mx2.circl.site/.well-known/security.txt
Canonical: https://mta-sts.circl.site/.well-known/security.txt
Canonical: https://nagios.circl.site/.well-known/security.txt
Expires: 2024-12-31T12:00:00+00:00
Contact: mailto:csirt-20241231@circl.site
Encryption: https://circl.site/.well-known/security.crt
-----BEGIN PGP SIGNATURE-----

iQGzBAEBCgAdFiEEfOoFvBafbTT14SZ1asA6ffeBgnIFAmcecYQACgkQasA6ffeB
gnIqVgv+OpITrs5ILJWsAx24MLQ7uaiip5kaalJ4G8ttXYAAOORzF89ptMia0ayc
BVAIjp0hiOR17DNtqUaSIYCAiLGA/uz46MjJbs9nFGGhimqQXUzI9sLSxBkTdZTu
vmlzf5Jb4loCPrMkd3TYxS5zOrdg0QyWskDgsRzXJYKNAuSHy0MMEgPhGWQGG8PC
ABSW3UoMaD/x7o1EbQASDcGmqYsNF5wOqIS4a8fW2TZT7xF4DCswhFcZlG96f9Q0
skcZ7Ze+Y8oxaMp+T/y7tMsu4SElXnfVnY3Lwo/mo1uU4YTjbngo+4pEcMZuBsR3
yhwKG2fdpnkgUHZ580kbs9jkbUNb3nCZPP80J9a9Ob8nuJPLMOp0zUw8BfSMzw0V
JgKT0LHZpEChwoT2Mpyo78Z9Rpcs5b/JWqT46z5ampnTfspA/6LhuPDTQSkKCmLy
4HqcG7gP/ekxHnzrne0w+Y7mx/A0xqpRc3k6NruUJ0eQQcG7LXtfB5z1xr1jS72q
w+tuangl
=2HXh
-----END PGP SIGNATURE-----