A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# Canonical URI
Canonical: https://www.nepa.com/.well-known/security.txt

# Our security adress
Contact: mailto:security@nepa.com

# Our OpenPGP key
Encryption: https://nepa.com/.well-known/public.key  

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEER3iC9RYal//QbvFmv81YerMLpWcFAmB1oYsACgkQv81YerML
pWdqsBAAmUHVN5QCp7eb0IxR7LCAirThAabEoycnHQZh48JT+KFH9QgiIYTzO39F
DNbPsQnSYCgQkRYD92hyv8cN9Cj2HubcVUww/xCd4e5DeyK30n2ouQ4g7sK2QyvI
8/yjY7gcFVzfDBzcG4fPxuPWeW3tzgyVVTUQXEYTPKYaIgXD34eqg8wCGnzMKmRH
Ci5yEplFYLndrQtDO/oJma6+RmfoduK4ffXm8kso5AKpU8l9ssjrN8ta68GDaAOQ
IhOffTYv06oe4ZGSiJlMQvvarfIHSWF52NRWfY8oFQAR42bE57ApsIQ1DOI+hDdh
S1zdKoC4KMXVwnPADcal0P5iWZHOin2Tck69A9hKE/x4O0M7QcCkfD/Bw7yUIZbK
3vgbXJkZmG61hYuMBBvy6VU2NGlEYUm/f5SPO1JOoW5Ck2KwIXbrycRIZF80bfWS
fABdKxQmQEhBkm9+gfzZ5sVBifC+AVyGrj99+YDb4SBFCcw3UNAexbDTiozLqjo6
pjTiZo9w4PkUNov8U7BhwyP6+dC2bm4RifTS5vD4zIrtQIl2Mz7hcDtjYFxwJKju
Zuj+aa0iVNuLYyDoVJRgyFCsY0NpNtoFpXJrX7Qqaw9m+WnHxUoL4lvO/YW2oY0t
namOENklOaEt+BI77zZn6vtZ7v6taHol/rYtUxJXOiEpcqMh37Q=
=VyvU
-----END PGP SIGNATURE-----