A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# Our Security address
Contact: mailto:security@contentful.com

# Our public PGP key
Encryption: https://keybase.io/contentful/pgp_keys.asc

# We speak the following language
Preferred-Languages: en

# This file is found here
Canonical: https://www.contentful.com/.well-known/security.txt

# Our Policy on responsible disclosure
Policy: https://www.contentful.com/security/

# Check our vacancies here
Hiring: https://www.contentful.com/careers/
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEEOj1aQq0SpW4YZlyDF7R1Dv6LZ1wFAl9Q/AoACgkQF7R1Dv6L
Z1zskQf/aLu98fL8V9LPlqiJqJcPrfCgmWaphStJf5RiFrLc/CqCBmtAEM5/tstN
PWMfAg5yumdEIP4qutZJLmwHevvyj4AYorMGA46zQQPXZkK9e4zOczJfj3ilrIu/
H0zhm4u6BtvUhXc0Gj6TK5Jh0Ad53yJlKqdi1Z462+yyzkZvuCNjoGw+TeyflXLz
m+EbTYhLb27NwZRWxFykZT5YDCws8o6MEchgtB312R4XWRZ7TxIN/gFCTluDG+LY
GhzkGAYe/KjlZJpWQSg28v7y7NX79GO4U/iFgidBWIr5OIz2U9mBJt98v9k2Btdr
m/CkXjvERhfu+pu/AjM9cHYFRrpnrw==
=Y6bX
-----END PGP SIGNATURE-----