A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:vulnerability@capital.com
Encryption: https://capital.com/pgp-key.txt
Preferred-Languages: en
Canonical: https://capital.com/.well-known/security.txt
Policy: https://capital.com/security-policy
-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEE+uxfx1PeLdKB6Z6hVCifO2O67kAFAmBQnqEACgkQVCifO2O6
7kCevQv/bRKnb6jngg7oko0mysEhtNZ2pguaOOWs2pMJfaZosx2Mx19d2LPDntQL
J0DsnHLTXX4T/fi8nX9JBXubnab6i59SjtjOyWCtaCpll1JCrwTug5576TuDug69
fju9yJYLiMIOSW3ERzb6JDC08ilwT9HoHz5VX2ur7WXACCWh+R7TA1ZCHYdTxDWk
g6q0xrFzzOR8GjSyYOPd3Sb/6rcFDaVimITwdsXj79K9ya+cB25mn5d+3s4gdJ6Z
Sdop+fu63gKO8zudeXF0LnZHXeK0zepuVDw1R+IbUkuDKvVuor/BVh/JUCw+NEr7
ZrVBcBfQjrK1Vhb6kzXL8PmHqhAXkOe4RQULt9o0u3B4fXAw2SegaeuMwloodG4P
Q6U5iJoH8sOrjfEPcRiAOribTQqTaug3PDYeCD1xnWcK6aJoud5t/yS3LlB242oQ
Pd2WeWpAC0aho3SUgU6cjMKgJtY56KVChcF2x/KJWuHXjmyq9y5MGkR3f8Z1Yesd
1PmberVD
=Hr4N
-----END PGP SIGNATURE-----