A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

# My security address
Contact: gregor@krmelj.xyz

# My OpenPGP key
Encryption: https://krmelj.xyz/gregor.asc

# Other
Preferred-Languages: en
Canonical: https://krmelj.xyz/.well-known/security.txt
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEZwzhY6uk0JCVi85+pDgd5ijipDsFAl7HAIsACgkQpDgd5iji
pDsdKQ/9ErbW1gX3j3XPrB1KUKUiz/xyP0b6UMl1nJ8idHSy/PSzv4PIh483e6iT
/rKvBiMpVmVbHhbR15tn5Wagiev2qJX/N4HIrPrBAs9rjB8SAH1rlH8hlcz0JyFi
K2H5EBiUk2gwvM5TH51Fgpe6Xt2CS6FFwI7TzZOcmlZqot40GaswCre7coNVjw8L
1VzEJDjW6NqbWot6V2+qlkYXHqOzuppjUJIa9qCRABCaybaMu3p4OZ9Cuum1Ql7S
RA2xEjt1SBXKrvzkqAEbBRJLsim6FFkJ5JPZC0xUbgSNWWpHXQpBIX8LoO9n5EP0
zySdKP9yycxS5DjeYoYS+rqruQF6oBtxouQSO7RiubOaQdD8wCHAD3BHng9H6bJe
NygrsjVGR+y4nXE4fNxRyOl6edkMlCrILMQC0KYPjZhAke4fgIpfcCO9/dFUqIkd
cQkykBr6ZqVJ/CEbqZM/XT+sqr/kTkl6zR//xkmbxFYefq+XAdMYi3EaOOWZgWGy
GUoY0TnkV/9OzY49ca82hwFxoT2I6hU4Goc6/bWyVoyV2RflxC7Z6PYdmqZvqZJQ
TbJMD+1LxgwAGf3Rqq4vu+euCvmApv4wIB/bYhaTN/mNLmgzogx8qDyFXEABFCeF
/ojpIR5Qopy3cv2iwfAyFyBRuZsJh3iDaxDinfNakfiLdxAded0=
=4siY
-----END PGP SIGNATURE-----