A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

# Canonical URI
Canonical: https://www.openproject.org/.well-known/security.txt

# Our security and operations addresses
Contact: mailto:security@openproject.com
Contact: mailto:operations@openproject.com

# Security policy
Policy: https://www.openproject.org/docs/security-and-privacy/statement-on-security/

# PGP key for security@openproject.com
Encryption: https://keys.openpgp.org/vks/v1/by-fingerprint/BDCFE01EDE84EA199AE172CE7D669C6D47533958
Encryption: openpgp4fpr:BDCFE01EDE84EA199AE172CE7D669C6D47533958
Encryption: https://www.openproject.org/docs/security-and-privacy/statement-on-security/security-at-openproject.com.asc

# Accepted languages in order of preference
Preferred-Languages: en, de, fr, es

Expires: 2026-12-31T22:59:00.000Z
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEvc/gHt6E6hma4XLOfWacbUdTOVgFAmdZ47UACgkQfWacbUdT
OViCthAAnmCDLmaYCAGveOSi5PquS5ELa0hadeZbWmeFn5G+dWjjv1Sn+Jqn9uE6
munarOE9435CxD2SdQgw4O6UC39Qf56/NkavUz9d70fjtXINsYCsbRZHYPDzITwc
lOtzYlwSnFYg5+f2wdArl009OKtpNIEonXbi/iPaN1TWOqmz9F48CHtf95V2NWDI
sI322XEz1vvd7xFx3fQdur7Ba6LPajP72PCQDXjjWhx0Cwaa5tfqjNnlFOspgqZ5
pYLfFYcL287MYA/QDcY3MzvfPIkuHFCrQ/6IBgBL264sZhYHLv1HnO/THGBMKypF
VE28exXcIX5awv6uksbfWHg0b9wRI7oYT7gioBzsZ5e3Dj05u4bSGOmLGKb+X3gN
zuwDuUh3Sdfq2z5+m47KsIJ9kDzN5MvGlK2l/yrKIlEag8FptMhfHTc6+SqGmOsb
P/I/bph+Sl9+Gjt5xJs9NfPEovUKbgx3OpHMF5b36VjrZ55fA/DUWeL1zEIyRaC8
3qPFnAkrg6WYZdy8OKvy1UoCiPIkLSdJO9UiOnFCojtgpa84DHxndjeTxQ7Rnu62
gElfjnYSUr5Bg4K5IBWlD6ROi4wf555fJohZUX/9qqXjsrizDxCTcMiZ9fio4kxa
7fJh40QG/NvQdKHMU1Yjy6eMKz0TkUL4FSwisu9i4PqDXZKDlTA=
=cNCJ
-----END PGP SIGNATURE-----