A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:security@grapheneos.org
Canonical: https://grapheneos.org/.well-known/security.txt
Encryption: data:application/x-age-public-key,age1dcftzgq00ykgwvxl5te6d5clqgx75h2g54c0u8gjc43mcnea7p7q3ma0yx
Expires: 2024-02-06T00:00:00Z
Preferred-Languages: en
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEZe7+AiEI4rcIy/z3+ecS5Zr18ioFAmPgqzoACgkQ+ecS5Zr1
8ipG9w/+JXdHECqyjF3VzPrutG67Wes4XehjxYJh7l6AQmYoV73daF1oaMXp2bTW
VzWAOijgYprwR0UUh5y3OqdeoDkuY5i9m1T3nxS9+L61eggkXcBi8UH3znUcMEfq
kKhMPOs6yN3hp7p6dI2TN9viuUQ+2vie8T3QkyqCjPYwPkoXQ43OWK2Tnb3OEZyB
uGTLeVRonEc4s3ih63t2FViZMaBN9s3Ei/3GGidBQ5OfxJcOb5FGqpA44X1Jua+d
Bxq/1NPzYM7oZM7XL5+YH5N7158OzIz+eBOH8jqir/bb8BGudUjoM2vefhPWt2t3
oI9XBbKwh/Ict2cSDGKPJMpl1BsTcvISVnxkYtKB7QbGUjMFzd3//Hvhz5A4r2fV
wrin+NsKrdiBxUKWzl6ntYTMizcdcoNMQti2MhXoWVGkn8bqN1zOkgue8n3STvIX
MqMmkAHwPQtZLhWOlkwSTetu4CWD4vOGp9vRno7wqqw2VpMYGS4PHy3SmnWIWnR8
827FDliIxmvKrvvlC8I/34WmzgBSsuPnS26SlDgIJ/YCsBQ74+mkCnERxcbQ9WtA
N9TcsrGiJmS2okn3Xf32HbTEpQ8SrrdaDMrCBg0/OuGHm/5hZbhkl6zX7qWGd4tM
NbUUAEvlpk7dYrBe6cpaXx3lDL+GD/C/CM6djiFxCJNDyU3DqS0=
=lnEt
-----END PGP SIGNATURE-----