A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

# Canonical URI
Canonical: https://cpost.ca/.well-known/security.txt

# Our security address
Contact: mailto:security@secure.cpost.ca

# Our OpenPGP key
Encryption: https://cpost.ca/publickey.txt

Expires: 2026-06-22T21:00:00.000Z
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEvlEtzEuTQ4KovQq3I5YAixjRlxEFAmhYpnMACgkQI5YAixjR
lxFA+Q/+L27gS2q/IrRLGZg4LWwl1zKs6egPMf9NfyVYkitqNb5wpvRhfjob1elC
1CBF8xb6X0XrOG6nsggG8FtTUOBkWMyHg9fnYZ7PNUOuvwCNvBGF34uJuxA08z1g
tmrZYBbR6xFbWYXmOEFzWrc2C23Ts0iTBmtOImD18NUWJnyahOwKJHTIPhsNRghb
pMYQdBOBk+8m+Pn9iuabKXDCdcEe7nVCTyeDYmNOqvbNZwhPrwNm/KBT/99CZTfD
Eqldf7MoOVGeooHgliSV3Xmpcy+VbJDMJCHTn1fEVmXSEyJTy0Jz56dz+E7eKp5h
tixYHG+5nJKh89D4al72mAHZ2i2Z6Kx3SXUKgigKrTvKG/SPFBhNsUYO84ACmCeQ
PiSxG89j+i5SAQMkO1sHhn7y9UeQ4K1BWIYfYnVjZJbPIu9CCVWxcgXDj5SzJKFh
yo5nWDoYKsLM48WVbWcJWUN0PgX5tVbzhEMKtkgmGNqWYGxxVCIqyqfSn0UMCbLy
yOR8An1JMgevkRVG7Zka5iDJuyk07Mdx/X0rJiRHczGHbdpx4zKqZqDIlwEzJPNG
d9iWbmcA6BZMictNLcUi+c6j8CxhvOdkFIug6yjLd6jzNwtr730BY5BY8nM5Ji4B
oz37cDofkaVR+BuwbHVY3CP8Ihp+zCN9wlANyXXAGPhe3lXzuiI=
=Dr3J
-----END PGP SIGNATURE-----