A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:security@panic.com
Expires: 2025-10-25T07:00:00.000Z
Encryption: https://panic.com/.well-known/panic-public.asc
Hiring: https://panic.com/jobs
Preferred-Languages: en
Canonical: https://panic.com/.well-known/security.txt
Policy: https://help.panic.com/general/disclosure/
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEE6i1R0iW3pPNCW77Iq26O7ibMLj0FAmcgJB0ACgkQq26O7ibM
Lj1knAf/d0aJgpr4jlEbViBQmzpi9aFbzfPgwOP7FTspABl1GPUNZFToTw6RAQVk
w+37zbod+0u3O2RSAIwtv/8ZQORf6LcyVlq3MBKy77/lUcnDu+jfly39BkWRFEtB
P6fYOhhzHItl3TryTmVYK2ciQWjn+A2C6YZoXhH+5tq7h0TvZzK43Lncel9KgeV7
pvOlDHPq9huJQbylftlD3ujwS05CbV3PyoaiqtpX6n971G6lcTXozckV3ZOH00QO
oneOZyCaM2Vf2ttOlRRQvMwQdqpDyZ0QfQF58K/5usF22YoHnNzSXpAakoIZV7fK
nvm4t/2HPJ4Ufz3hOEK4vCT92vyfSQ==
=jviV
-----END PGP SIGNATURE-----