A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:team@f-droid.org
Contact: https://gitlab.com/fdroid/admin/issues
Encryption: https://keys.openpgp.org/vks/v1/by-fingerprint/EE6620C7136B0D2C456C0A4DE9E28DEA00AA5556
Encryption: https://keys.openpgp.org/vks/v1/by-fingerprint/37D2C98789D8311948394E3E41E7044E1DBA2E89
Encryption: https://keys.openpgp.org/vks/v1/by-fingerprint/3DBDBA23810AEE377CC8E9D7C84324635610899F
Preferred-Languages: en, de
Canonical: https://f-droid.org/.well-known/security.txt
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEElyI52+aGmfUmwGoFPhd4F7obm/oFAmAK86cACgkQPhd4F7ob
m/os7gf8DNdzoz9uXtS5Kobr9vlips811oIrqIW5JTkZ3WDdbP7voD4VE61joSYf
rlvrHCdvSGJZED5JFunZteXXMV1agldnuguzcezy3yqQ39FqhPc6TWv5cN99xfoK
bptskJiTGuSqh+anXKSaQW0UNu4ubp+DlggtqBDaxJ/DdqFbr8RZM/73vXs0QEvH
jB2vIgI0obUv+ShqCwp0TpmJ96z/mF9q66NngXK0XZZ7aEBNYkPr0HeqJDYOphik
/QCI7FEzdwjmJ7P3OYBUHnZEnl/aKPks99dMnvg+kyY7wd1sCLEEAJdY/E4rtv/E
ix/nmP8eZUzadKlUdc3nFgXG4G9R0Q==
=PEGK
-----END PGP SIGNATURE-----