A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: disclosure@starlingbank.com
Encryption: https://www.starlingbank.com/security/gpg-key.txt
Preferred-Languages: en
Canonical: https://www.starlingbank.com/.well-known/security.txt
Policy: https://www.starlingbank.com/security/disclosure/
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE+jaiInsMIo9iklrxWxqGZYMZfKEFAlxR5HoACgkQWxqGZYMZ
fKHTNw/+Pt8cCLwomobPTCDfnmQBoxzL29X33m+6Ayh6xmO4RDzVUNrEhbx657vu
IQerGOUqLYLcB5kPz+Zyjphb+VNVhy2yXrcLCBMjJOo4wMPkKOayPeSBL3EWNVZx
3e6+B1cg8dmem1NAa+L26LTaEWwXs+1Yl7Ci5nKY14TIXCesVdz18NQV7c16Uatw
sVUQYwV21mZY/AKW5BtGXfgaFFlMZHTXLFP1JqSlGR61mind7ZxiqLPE5+BjLUzM
4I7abwV2rflnGwDkrIEDoL/f4A++0bmb65En9rNJG0WIE21dg3ZMuN/xBoWSqY/E
AFNDYWon2pu2XbpAviPWQTVL1bjD83Awn4rfXoEm+dCVrhMNZVDLwGry22x8H9NH
0NTwl+H5LwstTkOMl7RZ2K1O7oBjPNdEalctHep6zNZ3RfyhmEkPyy8eGoOILJAv
MmMmSdB0QHAo1H1lpwg/id3N4VNhGU1m5u5i/Sm+gQCkp82BMOLLWQiEWTwOAgV0
ttLOkxy2CpXLMMtK0YtULicCf09pAEtYWU7SnpxS9VVhvUvuypQ3xFp++qR8OWUB
+r7XpuDUi5i42fvPss9nxy6KLv8F/fakWmt9ohnD20GwaRaejrelktKDfyqdmQ2d
vo2cog/XOe3DB/FnNRfub/eSuhZAxmrW8UoEmn73/N9la1z0Twg=
=cKeF
-----END PGP SIGNATURE-----