A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

# Our security address:
Contact: mailto:security@leuven.be

# Our OpenPGP key:
Encryption: https://www.leuven.be/security_pgp-key.txt

# Preferred languages:
Preferred-Languages: en, nl

# Canonical URI:
Canonical: https://www.leuven.be/.well-known/security.txt
-----BEGIN PGP SIGNATURE-----

wsFcBAEBCAAQBQJhSx3vCRC7BTrI4w6h9wAAzowP/3HDRCeorfO6OaYG9O0d
3OJucUV+LBxGEhCSOhJaqNGbV7XLLPgbucXwHqQb2d3v62YtLwGToE7TEanw
65LDx9oBQlkNDeOc4nDmi4meRET/M7yd6hi+zXaEMBKkxV7ujn8JkXMiBh7t
oABbawkKtMeA0nNoxlmMOSP3OJa3AGcISLH52ne8v4LU4Bh0xg8yRKs9DtW2
jngDl5V7QlJdUysRxNBaCmAZaWj9Gv7E2krA6WpAdZ8KHl7K2YHUGVs1sC/j
K1FNqGDAjaRq/ESoX4uIp3lSPB1BA8uxGnKWitAd03pMqdE2aWw7trBuLSAj
lMw/8meA6amgK0hNi5Wi2DLsvtysesHmQh/hMThGGggymDJxoQJH7eRaByZR
RathiU8gK99PLoTFuLLXOGQe3K8T/i9YTnxWM0iCRf9b/HSkUZVqi7bHLXoZ
PDDLPpembiwrMOESMJVQ3FC6q2gCeBzLbm1tBi2EyeaK2zuv7FfaYmZe2jMo
OO553pl0lIHmDD+VUWkdJBFE5VySddfxpF/HKUIkfh6lGXphrKoiDG3V/fVZ
MMEqH5kALDxtR//IeLNZBMwHTT/P64UZxdTcMTUw4B3lgjPhIJWGoa4Q20LB
EgphwAoSA+FSvWfe6E+J41h83CvWTjoYKb1yo7Ziox22Uqg7cD3FVDSE4bGd
hBrK
=90he
-----END PGP SIGNATURE-----