A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# Not the most active at monitoring my online messages,
# but these are the best ways to contact me.
Contact: mailto:security@ndcrawshaw.uk
Contact: https://twitter.com/Nathan_Crawshaw
Preferred-Languages: en

Canonical: https://ndcrawshaw.uk/.well-known/security.txt

# PGP Signing if you wish, though doubtful anything I run for personal use, is important enough for that ^_^
Encryption: https://ndcrawshaw.uk/gpg/NDCrawshaw[.]uk-Security-GPG.txt
Expires: 2021-06-11
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEERO/g56ZzlJsLwrZdheHtwcmDf4kFAl7ijWoACgkQheHtwcmD
f4kIwhAAityHrDMMnOCHV0Sr2QLv3yjrjNF7uvsQ6cJo3IPF09ba66nle9IukLJK
vaWiy60HQYr1FfStmqs/PNNgxnIVc3F6YQ2DAZ7K2U/d/iHdBSLaxwerkN7wXqFb
GKuq90MNyyr/ccYXNFLO1tTYfmIwbtwkcvwmrfiQXUFdwMtFuVjb2mFVXYJUI9hg
3xXGZiP20mSE6misfYP5/BbwuKa/qAj2Y9HgRrZ8OXuwf0erUZ8bwdWkceLdTWm0
C2c5JcyaRS+7kMOlv8PxShtw0g2qnlWDPneiPIJaPYul6f8y/Xng29ak1lEAS+P9
4YMOgRzGh8dDsCvJXms7BWG0sZ/GxOAWqrhUo5rWyixDN/qWa02HxJStdWeRgXai
0ADhBaTt/rn1l1rJeAgdGhHzHlU7vRw/eM3Z39yBZmGGhvHec2PuYMFA7+0nj4h1
6mWUEwhfoqp9bUjLxSj18ZelrmOb8C4srN78xroukp4RjFjR8hZobewzwcbD8XDt
/zoh68JtYyj3Zi4KtG1LleiukXpj4qdyL+YDNu6UsA7iu8Ou6MAMKnIOw4hBk0Lf
DzMbQoAWDV3E1djme3LbDRan2VZF+674LIfo+H8xh4FIamwTwYYwwm9x1JRJHZwI
oME+eeWDYagmV6EbTkEn9hdKDgveFUouKI0YQrRWiv2dr9PMMOg=
=W6g3
-----END PGP SIGNATURE-----