A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:csirt@outsystems.com
Contact: https://www.outsystems.com/compliance/csirt/

Preferred-Languages: en, pt

Encryption: https://www.outsystems.com/-/media/files/generic/trust/csirt-pgp-signed-keys/publickey.txt
Canonical: https://outsystems.com/.well-known/security.txt

Policy: https://success.outsystems.com/Support/Security/Vulnerabilities
Policy: https://outsystems.com/security/report-a-vulnerability

Expires: Sun, 24 Oct 2025 00:01 +0000
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEHCXbuxv47MPNddjKG66kVyJKbHQFAmFtR8sACgkQG66kVyJK
bHQ0Tw//Uj1G+kDPtFRAGzGX73q8XlawT3iC1lpIrAsmCAity3h6/jxcDODVG6Ea
0me2XSdVU8L5Gz5Ipm1gst4bLV6PLY5czPuIzJIQ5xkecRRZddZcOnOfH2n5dy83
4xx9YDmco0vWpLAFX0KFibUQxM0ZHZYgmUHe2FveiSOVOZ8W7z8PiypTnkYuCFIR
lR51s+LuXxS+k+EOpWa73ORrqP3JUJdRFcVS8yUQKP5h/LgRNsbhtJSTcz5Ji3Ei
ABJxa3h8pEX++jbn62x+EKOrrTU5xyZvi6KVrlqmb0lqHIAbVUbuXjEFH+sMM5/4
bQ1LTqGJGZcdh6ltjjd592Ot6s6vhlTsoZsLyHfc/6X3N1nQoXwMxqr2PUkJv65m
4Ri2fJHYjLTlTj9dckW5vTCdlquV1z4Z2cqmihE/8M14+VAJvSIhsYoJcaO2KmOg
9bghyAYeuwvVZiukUt88KC1SONhhehhqkC5JZfzjSB7jntxhIThYDhvlO5NCKO2R
DFHqRiEx1xgfy9lwGgQTfcaaWFkcBJM3vyWJU3T64f7neAWdP3cJJ4JJNH69kPc5
kuOi/6VmXLhDkr2/DD03gJntOo/BHdLE5+W6a4ymnnvRbDcTzIIjh4Rp78mHWjfr
xC+z9sOMRmEZGNT8UwoUG9C+Mv8SKidYreH9F2QpqKtEsndGvUA=
=YknA
-----END PGP SIGNATURE-----