A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# All vulnerability disclosures should be sent to our IT Security team
Contact: mailto:it_responsible_disclosure@ecb.europa.eu

Expires: 2021-12-31T21:59:59.000Z
Encryption: https://www.ecb.europa.eu/ecb_it_responsible_disclosure-pgp-key.txt
Preferred-Languages: en
Canonical: https://www.ecb.europa.eu/.well-known/security.txt

# Have you found a vulnerability? Here is our Responsible Disclosure policy
Policy: https://www.ecb.europa.eu/services/responsible-disclosure/html/index.en.html
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJhQh3VAAoJEBMHco99VZBVZxcP/i0vU0pr+I7i9KnUr/ryAyxb
ca14nDVhJTmrijM1LhUOKGwaeWKhM5tF/0vju3aFOXausWLbMQyYy9UJOkXePZGz
GQX0f+fHRtMugSvba3RBhzf3MQmav5KdXTLZz4Ul+0121bzqSGYEg2qRj3xZzOJH
JYRSENCmamrfQUHerhpFHcFRmtkABPWHgYN8uFp8Xgb69GmKsO/oxuE/wj4+xBsU
sCEvikmW2YGLIlCFzQPW9GAv/l4kmfffsJ6B0PyDM89xvwXSY1lnoZ1laLm39Vk9
HQOwixZ0FAsMw3ZIluZ4FU9lGT4ukVTjBlgpfL9u0BmiHe9rjJMnjvSH8B0BwDL3
PC+cTBNp3r84rG2RKzW8k4PfAx0o0BHq3SLruAnelZZ/OlpGzauJ1EkTvB+kqeP4
cpOLZQkQQ2FNnUvFirsBs2EvQX2LsKt0HJFyOaiI3QXUME7ocZIxvhUVQqeRTDdv
rBNbbFwYOlETSYhvSR00DzxRnAGj7G+m406Ra4IEZ69IFxuBvhkL36luSWHfbig1
qZd9o7MxzkB4yAgD/6dCJkBMGi5bAmG1r6/LrkhUtgn8BziIQLukRg7dfG4uykIl
2YL/dynX9tmZc8ezIP3pgIkoqy9b+wZ3q1Up1qoS2Fyc6MOZ30uxKF820551qAIB
ydDoC/9ZaJ6yjuAhuxqL
=mlfw
-----END PGP SIGNATURE-----