A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:bugs@first.org
Expires: 2023-10-12T04:00:00.000Z
Encryption: https://www.first.org/about/bugs-first-org.asc
Acknowledgments: https://www.first.org/about/bugs
Preferred-Languages: en
Canonical: https://www.first.org/.well-known/security.txt
Policy: https://www.first.org/about/bugs
Hiring: https://www.first.org/about/jobs
-----BEGIN PGP SIGNATURE-----

iQJDBAEBCAAtFiEEdzURSTcimjwhKYkDf4xlZRP2rVcFAmNG0wYPHGJ1Z3NAZmly
c3Qub3JnAAoJEH+MZWUT9q1XLhkQAIO/LAkyKGXjP8HMqj7sRzF1h35c58n7ufMi
8Qr3x+0nfWQMWhxS6qVbw4HaWH3xknW5TrrajDLYVkRNjpXNaHj2u11B4f/FTCxH
bXrbWpDp4CfQuLXtc85RGRaWGJ7ht2UHpvhcmv4QwJXB3t0Okcu8sUKrPi31bPyZ
z7214lAON+kws0wgX7YNKWd2+94Zh3Tp0EBO6st3Eg2siAYPl1NIcuPvHxlVsAoZ
z0w8zcPGaI0euOcnN/nBlDNhAbtP/Tn+7SFJJyNczn9H0Zmoa/usjw1QfLAnIazl
V0/1TPESQn0aZw3yXeXOTDXEAvfA9m/0mOoNzyF+gNugm7Ba4c3TRD4frhvxKRG1
7Be1jZr9S2xOfFBKWA7IltIzjxhEtZDdU5VicRs9GqddL4uf8S/3x+DVgDb1vdYw
JXytO1TjV/UNJmY9jXOvhwDGcZkrzEgKTZlzvCQDbWZIVfffrmEVMVEuY/RC8rm7
9MDpUASxYr7swsnme0RiwMWoy1X56KoEorPXEpvlgnzZjXgjfcdC/v6SPr7KZa/J
9LvttbjbNPQrLhxdtfVMvezH/sbuQ3g0pF++A0iZRw9rEjkA5gcxoP4utaxS5PuF
kKPQIKHnIvMCTc4yQKMG+7dNGNtYISL/TGNjYew5butS2lF7Sb4AfzwJT9Pw1C/S
2SFO50OM
=Cr9Q
-----END PGP SIGNATURE-----