A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: https://hackerone.com/cloudflare

# If you'd like to encrypt your message, please do so within the the body of the message.
# Our email system doesn't handle PGP-MIME well.
Contact: mailto:security@cloudflare.com

# All abuse reports should be submitted to our Trust & Safety team through our dedicated page.
Contact: https://www.cloudflare.com/abuse/

Preferred-Languages: en
 
Encryption: https://www.cloudflare.com/gpg/security-at-cloudflare-pubkey-06A67236.txt
Canonical: https://www.cloudflare.com/.well-known/security.txt
 
Policy: https://www.cloudflare.com/disclosure
# Search for Security :)
Hiring: https://www.cloudflare.com/careers/jobs/

Expires: Tue, 15 Mar 2022 13:43:01 -0700

-----BEGIN PGP SIGNATURE-----

iQJMBAEBCAA2FiEEDnvvEuWaqyVBavSjIi/eggamcjYFAmBPxtUYHHNlY3VyaXR5
QGNsb3VkZmxhcmUuY29tAAoJECIv3oIGpnI2POsP/1kWotAtrlWGypZX310uXI+3
+626NkSbNjmc0akm/VH+N69o5RVdqTLsTwBiv4FfpUAsfMbyDajZgIS4UNuSDCSI
X42aao2mO6tsxgsur2QFiO+XelPVGKlSFNa5sOKzeF0aimeolrqLqr9BlrNX8yM9
7JRLHbRiy9MWKgUD+G3Gt0Hklze88fXucpp/YIg0Ddr/wv9zCp40yGtNnqP/V8Cq
eH5kM8RSMpywQca86vrRhgwwfVCxPaIRm/0PftG5nDvmVU1a09ol7KhaJZnV9Ahe
8qsD0SM9Dp3JCCDmPnB0bcI1VKI9j2R7P3n7HzIgSKO9sieZGtub/0Ew4dQceABk
5CNbQL2qSBe5hf6lP4N4nU2XaEvOpsdWJr0J3VOKIKFsMXtCwPrgD5jjxN64u7Cu
nUTGDUJ20BN3i04cDA4E5i+13K2njEhHAUi9gEOmEltR3STSuCSltXNlsMAlt5Nj
y4c5fl2NV6pJr7T6N/TM2I6cEF8Dmq94HhZYwbBzoTewrAkpbxWkB/fTMSXO9BzX
Sxrr/zp3nyUDzAs58Xm7uNdqcHomuPFhyzi8SPzz8EgXghUnSHQO9kIA34vlWCIz
BvDe1BJZtVjrGWvto5jH9Wq3RIAO+V1oaAZnKXLXxR8ZPUJBJcbIaUkAHeAbITWe
kYR9+KavUynwtfGaFXKn
=HDv/
-----END PGP SIGNATURE-----