A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

#
# IPB RFC 9116 security.txt

# Incident Response contact 
Contact: mailto:report.csirt@ipb.pt
# General contact
Contact: mailto:csirt@ipb.pt

Expires: 2026-01-02T12:00:00.000Z

Encryption: https://keys.openpgp.org/vks/v1/by-fingerprint/EBBA3870C79F83BD94EAF33CE3869A790D367A3B

Preferred-Languages: pt, en

Canonical: https://ipb.pt/.well-known/security.txt
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE67o4cMefg72U6vM844aaeQ02ejsFAmhmhssACgkQ44aaeQ02
ejvWZA//R6XYRfncly8MZcibgzcRPJUTr2kLqn7lvKujuFbKwDip1Erf4egWuZ4I
dos2NhZ/qNt9l5JNEq/xobDJZF4CbRkUiyD2NBtg7TJh6SPgHC9pHAaim1MrXbC2
ZUI/zpFJXFY0PJlf/ML/Nen8b8jWMQQ8KajSeznCFZFwoC0H85YhPpN2LG5MKiHo
lMcfzbIUdzPyyXl05PIvLZxiZGirLfxIiiVxUy7Lj3vluk0d67Ph8S9cZI5uEm/Q
DKch5b7Y6toHxGJ3u7d21K1CgbRUbVUvRBylm/YfHQZpp62mDyoPZQmo5Lrhajfx
z4LxZWeXfffeAH4lhIP9nFMM+92YlCCeGDVBMeYFJ2n9kRgcTTdOuw0pKG9Z2442
3QwwRHfSxMEB6qB+SLD++FLIxwv3sFe1jjL0eGknQWo4cGQwzOYgRkIq74iTeOO7
lk1N5oO14nmK+dxLxarD21MnPhFMIu1h9if7uhTQaXme0C7rhMMoEN1L9TWRDZJX
QbfRsWoNk7hZmXxMVqgc5/Sot5ajwZYkaj2HNyQ7/cuGbp23kvsP+WAEG59IbVxt
PwqGyLAqXbKpUxZWdPJJ1AbPdlaVCUGdVfvtoSyApywTGouAGpt0KrYUul2gfFjS
eel2wKGJkbw1thpx3/EIhgAP0172I7sFq8GeCqp4OtvDK+tEh2Y=
=6V/J
-----END PGP SIGNATURE-----