A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

# ███████████████████████████████████████████████████████████████████████████████████████████████████████
# █▄─▄▄─█▄─▄▄─█▄─▀█▄─▄█─▄─▄─█▄─▄▄─█─▄▄▄▄█─▄─▄─█▀▀▀▀▀██─▄─▄─█─▄▄─█─▄▄─█▄─▄███─▄▄▄▄█████─▄▄▄─█─▄▄─█▄─▀█▀─▄█
# ██─▄▄▄██─▄█▀██─█▄▀─████─████─▄█▀█▄▄▄▄─███─████████████─███─██─█─██─██─██▀█▄▄▄▄─█░░██─███▀█─██─██─█▄█─██
# ▀▄▄▄▀▀▀▄▄▄▄▄▀▄▄▄▀▀▄▄▀▀▄▄▄▀▀▄▄▄▄▄▀▄▄▄▄▄▀▀▄▄▄▀▀▀▀▀▀▀▀▀▀▄▄▄▀▀▄▄▄▄▀▄▄▄▄▀▄▄▄▄▄▀▄▄▄▄▄▀▄▄▀▀▄▄▄▄▄▀▄▄▄▄▀▄▄▄▀▄▄▄▀
#
# Everything can be improved. Including our work so far. Thanks for your help! We appreciate it!

# Meta
Canonical: https://pentest-tools.com/.well-known/security.txt

# Reporting
Contact: mailto:security@pentest-tools.com
Expires: 2026-09-20T23:59:59.000Z
Preferred-Languages: en, ro

# Scope
In-scope: ^pentest-tools.com
In-scope: www.pentest-tools.com
In-scope: app.pentest-tools.com
In-scope: *.pentest-tools.com
In-scope: ^ptt-logger.net
In-scope: *.ptt-logger.net
Out-of-scope: [0-9]+.pentest-tools.com
Out-of-scope: testing1.pentest-tools.com
Out-of-scope: test*.pentest-tools.com

# Useful links
Acknowledgments: https://pentest-tools.com/bb/hall-of-fame
Policy: https://pentest-tools.com/bb
Hiring: https://pentest-tools.com/jobs

# Based on https://securitytxt.org/