A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# What's this file? RFC 9116; https://securitytxt.org/

Contact: mailto:cert@traficom.fi
Contact: tel:+358-29-534-5000

Encryption: https://www.kyberturvallisuuskeskus.fi/sites/default/files/media/file/NCSC-FI_Incident_Response_2023_pub.txt
Encryption: openpgp4fpr:68e6ae087d604e1bb7b077b1b08aeb4c0b702656

Canonical: https://www.kyberturvallisuuskeskus.fi/.well-known/security.txt
Canonical: https://www.cert.fi/.well-known/security.txt
Canonical: https://www.ncsc.fi/.well-known/security.txt

Preferred-Languages: fi, sv, en

Expires: 2024-01-23T12:28:53z
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEaOauCH1gThu3sHexsIrrTAtwJlYFAmPPzwkACgkQsIrrTAtw
JlaPHA//d1g2OIiFfBFd1af7XmzoqpolsodDPFuMpPcn6pGjLC12pVfPKypb8opv
GBAJt5BQgbOtUHGmNpVF2aFvHd7L0pGnpzPTWcp6IS/a527rf2NK/JCr9vRUcNbV
4nh6lJg2YSFmy7f5N/DvH3lBaDq7YzYT9nR4+8uxuMax9iLCJFZ1G/eBJILUJ9L9
65MWHumy1K2E5pHiqtgDSb2PIUUv9W2SoJJPZF17wVHZilGOhXZCphR2AIGIkax5
eRhxF5o+PvWIqm9Cx68PG7f/8k/Bvn++Sh7Idwjj2uymocmdb3VEEyePVME8UeWT
4Q07GdKyLG+84f+R/+lYP4N15QGBiTVu70a0JBIsBlf80JT1dX+73DT+Lv+2V0y2
d1VXCKH5fShj1EKn+P57olXDXfyHwk+/7DyJ8BrFqK+Dxiab4ratDGQvBSdLK2ps
aIl9sI+lBC0DADBbaNnugZMY3oxZVLGBvAFn8eK+hpf9tdp8bsoU6hPZd4kCJ7r5
AizAzIvDOPaKRL46nw1+TcWuLJav/Dgj0sCEYAUGKqFLqLmEfY7em5AA5oajikmy
a4owHRDW7wawOWMhZdUYRkpNC/Pu/742bYA78FbrnEF+B8k45ZhT3tOy3b+0Ce9s
XEDYaCAWUtwDze4x8ZxcXZm86hecOIaqfJPQvDWumfI8cf0Mt9c=
=ZhUV
-----END PGP SIGNATURE-----