A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

# CERN Computer Security Team
Contact: https://security.web.cern.ch/home/en/csirt.shtml
Encryption: https://security.web.cern.ch/home/CERN-CERT_public_key.txt
Preferred-Languages: en, fr, de, pl
Policy: https://security.web.cern.ch/home/en/kudos.shtml
Acknowledgments: https://security.web.cern.ch/home/en/kudos.shtml
Hiring: https://jobs.cern

Canonical: https://cern.ch/.well-known/security.txt
Canonical: https://home.cern/.well-known/security.txt
Canonical: https://home.cern/sites/home.web.cern.ch/files/security.txt
Canonical: https://home.web.cern.ch/.well-known/security.txt
Expires: 2023-11-01T00:00:00.000Z

# Please see https://securitytxt.org/ for details of the specification of this file
-----BEGIN PGP SIGNATURE-----

iQJOBAEBCAA4FiEEfY3NUMWhe1W7XSsfl6NR5spMkb0FAmNaP18aHGNvbXB1dGVy
LnNlY3VyaXR5QGNlcm4uY2gACgkQl6NR5spMkb0GMQ//X6JV9kdGy/XiqmD9GJHE
bZOy4XCioHw75OrGOcU8NaiwaQt1RPsoBtZ7QZiB11J8DlMd6A04veajFgdHIjve
n2bKz/Uzo1adRPEzGQfZQyXXOu0Kn8n6SSA5v7QgwJbRN8w2EDnA2FeuGBfft8Nz
4w418GvEjYptBXNhzV3NrfdII9XZsg/mCTLfBiRsn994nuIZVVEnNbDHt+Ovwcti
qbw/Hc5dhtViG5lIhydZFffclYizdV1rurq4LJGTQMW6I1ekrD4mj+caY+vuNZR5
t8vAfqGwMKJ5pZzZvIRmGQuh9AngKeF4WY8FQKaKEG5hI786+6Au2GFXOlzwWIdK
Y8j4IvT7C2RE8fqrsHnRNrdGqZFGLexTyDPOAf5CFw2LFLrR+zfJOQeepIkdrW39
qu6S85mtdDH/uHlxzWhG4P75ncWFwyFrATY6EhJWnrJzo2ldKpHBCHEhyKRTcFzU
aKHpgKbkAR6mFpW5rJwT/1U/kUMtvh3B0yDGBk1kIojbtMKLz9aYe9dCnmG6fB7D
yQNiL/p44/DSLE/+9srUGpt+CharMI8mBSL8Eg6+VKT0fjLOf3j1cJq53OSvs/Ja
L2nezlOhHTWx+XHR/dZipwQ7JsagkGBK+32Rytvqtd+Y8t87t7EDixYUTPRkCA2T
KO/+1YeGIS2uRnonc9KTsqU=
=urgl
-----END PGP SIGNATURE-----