A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: zr@nah.avawn (rot13)
Identity: https://keybase.io/anunayj
Encryption: https://anu.ninja/gpg.txt
Preferred-Languages: en
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE5cUj735DPXksdTDHzK/vzMzMzMwFAmBOnbgACgkQzK/vzMzM
zMwnwg//Wlu3Z0USmG4PXTzdlO0o+QixlTLjCxAw22rmQOdTirZSsp9M4fkEkkWs
lVnKsAbR9h/jt2/eXdqIWs5JCctdekrpXcTBBSnTTZNg8YFVTlWdZsKTIQFwhDIe
w0SgbmlnL0tM4jluR/m4wvVTDOd5VaYB4xn9wZf8mvmMLgcKEp6fcu1EENM94gOq
0K20oXP6fLNvIvaK+etNL09vSQ6gn6l2FIYg6TctJ6xBjW0uxo9l88kZECkm09Ob
wdsmeWPFHUU3OslmamAlGKGWRczXjI9H4U+r2UrXMs7ymURA5e2ECAjt1YD74AL3
a98FaihrzPNyKbVXuSJz5SmavPodu/0Htr6rWAPJODpDKCdP6LqVgy0vy+nu1KQn
25H+/2moB6xf4weRwgwrHPE33uM25yzSXjDrYCTUwgoMOCRPKmEikwHRCVZz6w6W
70HEq9lQSJOqkBLkC6h1D1jO43wMByHa/+4ByR9Y8iV5M9ai0uSdOfuJbGo9VCWG
JfAWkHoJnDxpIwsrRfHSz9OZkn67FBE8vSwG4b0BwcIwBbC3zTwxB6+hAR58wIvp
uPbCx05gzXeh80xUgW235CB4oiDBV8JCNFMF9SWjeNnR397PatuZD38QOJlPnLeM
8ByGWcX3TAI1UHLM5GfhV+9EpYCAGR/ThLxCEzXs4Yu8q0erXsc=
=42JF
-----END PGP SIGNATURE-----