A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:security@attestation.app
Canonical: https://attestation.app/.well-known/security.txt
Encryption: openpgp4fpr:65EEFE022108E2B708CBFCF7F9E712E59AF5F22A
Preferred-Languages: en
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEZe7+AiEI4rcIy/z3+ecS5Zr18ioFAlzk1cMACgkQ+ecS5Zr1
8ir3sQ/+P7hj3ZotjYgx2M4D8g2vt3MembdN9ZvQkbUaWuvvsxFJoU53gXzkGOzd
W1tSekojGJ6KrdL3NHSqooiBpvGUzeOlQuU0EO2BPxp8gYRMXf/96kkCJPveKV8h
8o/yBqz5OWGVYs7NmoaKR9PrI+MBgniR+hqNYMx4cosiIJ2R29QlLV9WYTW9V68I
hHqZrK3W+YLuY05JXhh+pCkVXfjF+rII5lbltzo6GRFxiv0m48MPh9NOS/ayvCI3
iO+TmEcPRwnOOrCAqYVog/33aJL0v2n3p7DPoriFSY3+lf9o2hf9c/AuVRwu2lOu
Wv/cpavRorGaJR2WHDZoETbUgyFT368qneg8GK8xXyc9BgsHlFP4xXFJC4j21c/g
NkHF33PKrGbtdQLI5CdjgJRc9O75Nh7belPiYgk5N38O2cWUWD/kTGFYPfxbLTVi
cxo23OWLSildMb6BQAbuUCsleA6H+FX6v5SfL7km01E9H84kCvdQrkajhkVL0jWB
h21Y+W9qzzgbTLivjoCmZqccdDgrtVnI4UwFDeISu6B037za8uZi1FJmxZ8I4TST
FMuho9OSXrkhXdJdnnzMLLFL3KlCGghpEhRnu0tgAqYhx1zJCzDjvmT/XcEj9rep
XTY0V3OJPt+9/Fufdg+8++7KjO4vwPZaGynO0shTcfBG78VRZAk=
=je1C
-----END PGP SIGNATURE-----