A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

# CERN Computer Security Team
Contact: https://security.web.cern.ch/home/en/csirt.shtml
Encryption: https://security.web.cern.ch/home/CERN-CERT_public_key.txt
Preferred-Languages: en, fr, de, es, pl
Policy: https://security.web.cern.ch/home/en/kudos.shtml
Acknowledgments: https://security.web.cern.ch/home/en/kudos.shtml
Hiring: https://jobs.cern

Canonical: https://cern.ch/.well-known/security.txt
Canonical: https://home.cern/.well-known/security.txt
Canonical: https://home.cern/sites/home.web.cern.ch/files/security.txt
Canonical: https://home.web.cern.ch/.well-known/security.txt
Expires: 2025-11-01T00:00:00.000Z

# Please see https://securitytxt.org/ for details of the specification of this file
-----BEGIN PGP SIGNATURE-----

iQJOBAEBCAA4FiEETnt2gsUMl3zM0Tg93Mk28VwCJ3QFAmYc76UaHGNvbXB1dGVy
LnNlY3VyaXR5QGNlcm4uY2gACgkQ3Mk28VwCJ3Rr0BAAhl6XXFiR9SE/NCb7v6yP
uAN52YlzmXxHooCkSccAl62ajzGcMeBQ2lZKpcZoS1m02XaODNS6JHvpw/2v37p6
bAFF9hNF13v45MlxpoRUziOJ4zaEwE8s/NGnVKA1IWxS9KC5bOMnh2ZEz/KLRgBA
l+9IzED+nD5RnBkgjy2nDlGZM4fDuBbdV7QMV0ocNXbgP2iMVdBQX4iug2fhSQUx
T1wbPpfpAM0opJdoZYvKT2/cA/QLULl0942zwwbMjkXQ0RutRpKerH5QB+shknxU
Gc2Zoiy78qVdUUm2cyKlhC20A67gsc1y+NhQSXPQ0kZ4MKGjZQ14qPxuFvnTPnGt
5yovzGnolh3a5AOXimq46VAEpMS8buJHHlDGbzBQZzC3MuKelyl07onfVV3yOhmM
rQyvqAzE6hRLvRk59SHVgambPjI+O8ZmH4TVEeTztF4Gt0Br1hGf5Rib5ob5ZF3v
fSCH6TZ/1m5cTH3r8XuyHdTWDVE81qVZocXzjnwB3eqxgU088FwCly3EeAAOdUWh
9Aeg4c4bdHSBe6fyDrWKAMhscSLmwvJ4mRxYUmrEqPjxYN0RQV8uTwkJMO31L0w5
CaMn/43KSaOMjeOnF56tH8eh7oCWoMkTMkqhDaEQOTa8+X1g+YCFzbgYcuMy1Qko
UdrKTroxaBmwr0epDCSa+hk=
=raGW
-----END PGP SIGNATURE-----