A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
 
# Canonical URL
Canonical: https://severstal.com/.well-known/security.txt
 
# Our security address
Contact: mailto:ib@severstal.com
 
# Our OpenPGP key
Encryption: https://severstal.com/pgp-key.txt
 
# Languages we prefer
Preferred-Languages: ru
-----BEGIN PGP SIGNATURE-----

iIcEABYKAC8WIQSrHG63zEbO0y4vx3krvkNlT1Dk7gUCZqjnrREcaWJAc2V2ZXJz
dGFsLmNvbQAKCRArvkNlT1Dk7m2lAQCz0kgy+1eRNHFvy7F/BYlUBcAoBaI4xAVL
BR41A0mIHAEAk9NA3Cq3NMqOJplu+v1HRn9FYhxF/d2lOYg1JycP0wI=
=Wjt3
-----END PGP SIGNATURE-----