A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# Domeinen van Saxion kunnen met een 302 redirect verwijzen naar het
# bestand op https://www.saxion.nl/.well-known/security.txt.
# Daarin staat het centrale meldpunt voor kwetsbaarheden en incidenten.
#
# Saxion domains can use a 302 redirect to point to the
# file at https://www.saxion.nl/.well-known/security.txt.
# This contains information regarding the reporting of vulnerabilities and incidents.

Contact: mailto:csirt@saxion.nl
Contact: mailto:soc@saxion.nl
Expires: 2025-12-31T22:59:00.000Z
Encryption: https://keyserver.ubuntu.com/pks/lookup?search=csirt%40saxion.nl&fingerprint=on&op=index
Preferred-Languages: nl, en
Canonical: https://www.saxion.nl/.well-known/security.txt
Policy: https://www.saxion.nl/over-saxion/organisatie/coordinated-vulnerability-disclosure
Hiring: https://www.saxion.nl/over-saxion/werken-bij
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRjp7t5YlRK00oc1WOknqZLgGZT9wUCZ/jB1AAKCRCknqZLgGZT
92awAQCU3UzgTVbPyV4QJto/zYhS1aBcoB5O+Kv63h/VNlkK+gD/Uw97r3JK1LEc
VjREImxDtIlmxXg8nit17mCzWQY8sQE=
=YJMl
-----END PGP SIGNATURE-----