A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

# Unraid Security Policy
# This security.txt file follows RFC 9116 and helps security researchers 
# report vulnerabilities.
# For urgent security matters, please email security@unraid.net.
# Reports should include a clear title, description of the issue, steps to 
# reproduce, and any potential impact.

Contact: mailto:security@unraid.net
Policy: https://unraid.net/policies
Encryption: https://keys.openpgp.org/vks/v1/by-fingerprint/5461B0B9C1CCFB6E53A6760FC5D4DCC26C348C7B
Preferred-Languages: en
Canonical: https://unraid.net/.well-known/security.txt
Expires: 2030-12-31T23:59:00.000Z
Signature: https://unraid.net/.well-known/security.txt.sig