A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: security@liferay.com
Encryption: https://www.liferay.com/.well-known/pgp-key.txt
Acknowledgments: https://portal.liferay.dev/people/hall-of-fame/security-reporters
Preferred-Languages: en
Canonical: https://liferay.dev/.well-known/security.txt
Policy: https://www.liferay.com/security-statement
Expires: Fri, 31 Dec 2021 23:59:59 +0000
-----BEGIN PGP SIGNATURE-----

iQFJBAEBCAAzFiEEkyWmm2ge76falBIz0rVz0opHoP8FAl/J1ZAVHHNlY3VyaXR5
QGxpZmVyYXkuY29tAAoJENK1c9KKR6D/BVcH/1QucFXsagUx0QoqHRgVk1F6wL2W
ZrZS6PhL5c1F2s9MJpKAdnQlQHPECyykDC5Fh2qxJcPDsRBfNTSTDx6hpfJJiIWV
j0qoIypoWWjRsQHdYzNRo7Xl4fqIJoicqjATCcA7nN0BO8ayTUdOTRhL2CcLO7KP
cn/rQdhZCu06sfVC6JYuOMugUF3J3/6EuhmHaeiIo8cmRfcTE5eTM8m/jefzBizd
+g3xuTQSO7HR5XPDn47Wxyn494m0nFuEkgRBRYKAXYGO/wQpoKfGNh4lijfKYCvU
u/Gbx+1nQyyofkCdv+d95SRofchthAQgsp3gtHJtbYGNhIRhEqqOxYtXBQE=
=80vx
-----END PGP SIGNATURE-----