A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

# Found a security issue in SilverStripe managed infrastructure? We'd love you to responsibly disclose it to us using the contact details below.
# If you've found an issue in any SilverStripe open source module (e.g. the CMS, Framework or other commercially supported modules) please see https://www.silverstripe.org/.well-known/security.txt
# If you're not sure, use the details below and we'll make sure your info gets to the right place.
# Thank you!

Contact: mailto:security@silverstripe.com
Encryption: https://www.silverstripe.com/.well-known/silverstripe-corp-pgpkey.txt