A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Contact: mailto:security@londonmet.ac.uk
Expires: 2026-10-27T00:00:00.000Z
Encryption: Encryption: https://www.londonmet.ac.uk/.well-known/Cyber_Security_0x46B717DE_public.asc
Policy: Policy: https://www.londonmet.ac.uk/.well-known/svr.html
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQQ3afuiROLPeKPxbvuRnPsLRrcX3gUCZnV8gQAKCRCRnPsLRrcX
3pwPAQChA26fH27XPS5SyRVr52kL1E2y/i+rWUy/Tu75eIkQTQD/cD+JRg0bTBPG
Q+wtc7PjvkEOZSgulGdhzkcPXe6AfAY=
=gk78
-----END PGP SIGNATURE-----