A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

# If you would like to report a cybersecurity issue
# you may report it to Southwest Airlines at:
Canonical: https://www.southwest.com/.well-known/security.txt
Contact: mailto:securityreport@wnco.com
Encryption: https://www.southwest.com/pgp_key.txt
Encryption: openpgp4fpr:2C2D7CBD437FBB9DEE4CFB666A5CED2B8E440317
Policy: https://www.southwest.com/security-researchers.txt
Preferred-Languages: en
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEELC18vUN/u53uTPtmalztK45EAxcFAl1B5nwACgkQalztK45E
AxcDDw//Uu7X+1DondlYqrlpZiwmh0efj0rgNQ8FBgb3mCbljrHBE53zalw67496
b+/lk9TRLbKbddpirL/bVBAJD7vZh2qCOh+IXARAmwnN2neuAw4mlLnNxm7tRNMj
rgV6X4pN6rZjZAIRXh9GQLjbVgFSKZBQRlgI/BWSGWRmqw1s0VW+pK4fxM1YcPOk
uwfiaJk2A4lV09JWOhwZ2eZt2DYMewx0Wx5wlmGfpfxeUO08YbxkCb8WmhXfxwK9
iLamjn1XLh4M2DBw8XMRtaoVF+aXkyJUlvOVNCj676+y64PBCyOEbDRSxRqQC+dL
17GP/D1zzHh5JZkeIXPnem10YpEtak5IJ3epptgVgXbMvPCpVOXX8pCBubu3WhfD
cg1B/EvQBHs3OWKZouB63mbqfEAyiCeYcm5/dNO78L7u4ua/i8VdQ1egrQ30kg8K
d9Sjns5myvyEHQVuLYs3OT//kK1nDb4UDnehrwqJIIviJz5FwLIjErI+Qs07yg/C
rs9icR7Fygu1pARM0RBSXhpMqmhx44AmhiPT5jscKKB/6THlJz6sexrn6a8V6xrI
WwA1z1ZikREX+tAwqx5yrGgNsSIc9Acz2r6sfu1mmSP3Eu5evTDyoSxuBA8S9j7n
wwGLp4BW+kI4v7NlbaVdguRrbOQBoVUevBsCd1IVo5LWyAQBnD0=
=RAPX
-----END PGP SIGNATURE-----