A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Contact: https://impact.responsibledisclosure.com/hc/en-us
Contact: mailto:security@impact.com
Expires: 2030-12-31T18:37:07z
Encryption: https://impact.com/.well-known/pgp-key.txt
Acknowledgments: https://impact.responsibledisclosure.com/hc/en-us/articles/360063057853-Acknowledgments
Preferred-Languages: en
Canonical: https://impact.com/.well-known/security.txt
Policy: https://impact.responsibledisclosure.com/hc/en-us
-----BEGIN PGP SIGNATURE-----

iQJIBAEBCgAyFiEEFbBpNrALNd65xluwPWVLtbE0w+gFAmYQSJ0UHHNlY3VyaXR5
QGltcGFjdC5jb20ACgkQPWVLtbE0w+geBg/9HQnSSZotgr2OD8kgo/eiLGbkcovb
yPcr5NfLzcpF5h66XRnZ12ceF4hQqiJSM+D5qpA8Vu77xNuEeVG5IMIl1Yx2Sgdt
/g1RWk3whO68bxvW3318iQPAO50oi6ODm6pGqitrk2dOXspcoov8KUOPtcug025v
vYJ2/4/6QCjuaKywYgqrwI642RKMtw5x4NPzTHHfoVj6Wj5C/23MPwbuvvVbs8Sn
1YuFvmsjMepFmHG4ziNSRJD+AG3eOvgh4FnAUIrIMuaPegL60oEdgw2kCIBbOIgW
vwlQ92GCKuUNglDmskFMe6F9vIJQpmFNsLwlRi3BhnnRrogD+dzwO3kIKmel4+jA
5waXrVY7sRCsbHp3MjlAMxOCHc9trJOUQEKBTReNocgkYe5sAsDDR7Y2sl9Ghqug
J17jOCFX+QHbOCFr+GiDyH+h3SUSrSxo/GjgDFYJpYrY7fBCjSVoYCOwEEBmX/0g
ai5POh5raeObROQiHNZrNIRlWmYTMONGYUBtAVBVwJrD6xGps7INDUo0IN2KTnJW
VQYv6pX8heUErJBpnHunNA0ZRUXXEozOspGEXtb1crdfDMzwkHf6/FIY65MrDuWT
609vY2vRPsffDkYti1ezrDFKq3NjgOjjE1EpM9GMRxMro7G3vG8gy79Z6HVhpIx/
wXIfc6fP21eDa7k=
=6EMm
-----END PGP SIGNATURE-----