A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:security@uploadthing.com
Expires: 2027-01-30T22:59:00.000Z
Encryption: https://uploadthing.com/.well-known/security.pub.txt
Preferred-Languages: en
Canonical: https://uploadthing.com/.well-known/security.txt
Canonical: https://utfs.io/.well-known/security.txt
Canonical: https://ufs.sh/.well-known/security.txt
Canonical: https://utf-staging.com/.well-known/security.txt
Policy: https://uploadthing.com/info/security-policy
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEXIqeXOo2xLYF083O7aBSGo3XMCYFAmeb3AMACgkQ7aBSGo3X
MCbRhg//c1i3ZJ8XN0pdlmEIZYz1oQDA3L9KYu8gXHxwoeyjfT8fZOIW8W2uT6vl
Qp7vsUi+BQRThflHMrrfzsmhpV8yggBRsyOqzq0auS3pZNbFOaId1keYbdTkAg6+
TjTxRdGxOV2qXoFcC1TYjFnH5mAmi7vKDIoyqcjop6H3MKfQhZF/Go9MWoj0LIOs
d94T0qa67BEOCKbehnA4FFduePvjN45grHloENp+tWNUSr2bSN+DOhOvST0S5FW+
m+orM1TZjRwYM4XnEVJxUsi4NxttLTDRqMGmp5Wxu1+pEzCBJ9GpO2D4mVjO5OVi
Ipvny/dT+diwwl1KPJOLpj50KFChoEGTZ5tl28Uh/0WGoVP8o9jbhB32uWKATiK1
/UlzwmjlFh/cA7cxxI2Ic0ElRJE/HHTrjFy2Qp3L/rTJgH3zWt7GH5bHw8Svxq/R
TYaTKn+Rm0hYg9j8yfT36WXFzVL3sQ6PqSxUxDZ/Bs8CH5+l15G0Adn/tPH4iRH+
/v3uJunl8qlLnJF/xhbxRLl17yI1mGLaeFOiMKGhkBr1Z5dvnQ422Mw0pjhfstY0
oZCwFsFRF2UAsM92JbqdBN3GZv8Pajz7bxurBYiOPDz8pkTgTZNUjTy7HegBl5kM
Um9Y6jnXNAQ/51SGZNSTmT0/o+1n6dfQt6zMYH24Thr+7F7Rq9I=
=nABI
-----END PGP SIGNATURE-----