A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:vegardw@gmail.com
Encryption: https://keybase.io/vegardw/key.asc
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEXJZ0JXcXGautvZfCMzLGHiqvCecFAl0LaUgACgkQMzLGHiqv
CecKmg//S9E7yXbq0Gnj6vSYDpUhGlUUCAGlflO8Zyr//h51ODS+AX82VLBl+UfX
AoIwGSl4KTd9NlBMMrrgBFW3lGkR6wHQGbcCqSp48GLZ8K0Qqd3qkmeb4NZC1PMa
/hOW3nktdrWIenAtnbOuedY6sInbbJiv5mdEJgMAeSGjZWr8sj6TRYKnAl9UJrrq
uchPm6xN55/CNYwBcnErZZojvSYI/CR+w1zWxh5Li5F8lP0ckHYfhnnOIX3FOjfF
ihZiWM2+2aftIWv0JKWtEnBo1/v1+TQZPzJIFpM0bpE6ZmwslmIbPbACQinfZIVf
9ab+T7qccKiY9yUZVv7ZLUBVFO4GbEnFkGmOYLIzaGBvDYOe9iNcDUQ6Pg32Pywo
k2OoonXk6+IOiLMKzNMEje7od07w7TU7OUzmDW8OKnOegbMEduPJQoj5sIPSAhSE
Hv4nhr7TSsKN8cCb72faw5Mqx+Cc8kVK1n3Ef6yLJEfgpIoV15Slf5RGNTuBPV5x
vJCp4hMj4fbqsoOT8IemTmQlR8WXZL5emaHWD+Yk186SfWj5DC7bW7Yhs+gFgwjW
sauQ0cPIiJS8PV1P50ipBwF0epE3qgdB5XXBlZXOOw9NvGgnhBOcc+m1TdTMsjue
jS7FkjpZgNfvEmBUkJlwSjom6x7wtJaWkOsDUFQXHYzHY+tEn9s=
=Z5ae
-----END PGP SIGNATURE-----