A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA256



# All vulnerability disclosures should be sent to our IT Security team

Contact: mailto:it_responsible_disclosure@ecb.europa.eu



Expires: 2025-12-31T22:59:59.000Z

Encryption: https://www.ecb.europa.eu/ecb_it_responsible_disclosure-pgp-key.txt

Preferred-Languages: en

Canonical: https://www.ecb.europa.eu/.well-known/security.txt



# Have you found a vulnerability? Here is our Responsible Disclosure policy

Policy: https://www.ecb.europa.eu/services/responsible-disclosure/html/index.en.html

-----BEGIN PGP SIGNATURE-----



iQIzBAEBCAAdFiEExVLqv1rU1AAQoD1PEwdyj31VkFUFAmdYpQIACgkQEwdyj31V

kFU/vRAArRBh+ZVLjoRfRlZLHHXjKYDuo0QxiuadvcVLvVQA4puJW7pPr8xOD3zM

o19+vlGwLgHYXEzmEEwR026vALjK2oLjmU5hMR7MK60HlyNvwuhLGztyRGJnd3sy

lkd3ni7Mrv0wIZvK60YrJHew5gGFTNuhxvzbgSJ2zxMM+1w5Z/Yzrd93da96eyHW

nAi9EZvC4WhRxq078ah1ZepjvCkyI/eauTF/epuQtNyqbCPkyClzpFck3JObXiS+

9m1woVxDR+GE3SmdmKAKJNaUhHw/JqiOpJyZz1crYOMo3Fpo3S4a+EdnWsXv4RTW

uikq4xHdrUh2qPBhAq4FrjTnwgkwHGgnzmFI2RAMuwORYg95hn9REhtdNEhXpM35

UXCbzZ/I500CFZF7YLhVWPKA/Ppj8o5+SCWaHo/qdJXhYKlX6LTpoIf7fV0nezBw

ojIfUh6RLEsNkI8duWr3YMD3mDY/QZQK5hg35p8bpufwGHJI4ACnUHNdzTGUAVBO

eSktTYUG7eS3mFLXCDg+UtNn4oz5y2y6RFynQGZjYeHEc4E47W9PYBsp5dp6W98O

4HqTIFVGB30L+/ZKRMhZUsoTvssDKdvrFOSqvYFdNZ2YUGOWRlnDn8ZKI90uLCFG

uFBM+TzG0UeDwjjWC9x8IgjKsz2/XKaoVs3TLhmWJ9oNqv3eKUY=

=FU6L

-----END PGP SIGNATURE-----