A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:security@cloudbees.com
Encryption: https://www.cloudbees.com/security-pubkey.asc
Preferred-Languages: en
Canonical: https://www.cloudbees.com/.well-known/security.txt
Policy: https://www.cloudbees.com/security-policy
-----BEGIN PGP SIGNATURE-----

iQJLBAEBCAA1FiEE9krp2Z3b0dWmkLx0kATK7TQe6M8FAl+lMUcXHHNlY3VyaXR5
QGNsb3VkYmVlcy5jb20ACgkQkATK7TQe6M9RuxAAmv51utRCtZCDOipz4rGAD2oQ
C0ThQcuS+eSZV/SclElYHjthnrIl9pqlWNr+3FXq4RPhho8++iurJ57IFIWSEuQF
EYLUKaDIGvy5aGLZFb7WJ6I+2E1FrckYO+aqvGCjrVFtUKWZGYic/ULnxae/+RY7
Y81R0eZaI2zC4NPLhrvkrzPPR0zhNyUAa7KfmXDYl6HBHEqP78OqF99KaC3KgydU
ZmO/+fLbH+meV4W9pECD7qdpUe+sNqy3Hc5WXq0LQB7htBcR33hd5bmpDklsSF5X
f2+uunlfvs/TtRmSCFrImeEQ2Iq6vxDp+8vhgBX3wRS6HAoo9b0OBCoT4cSoNWiE
xQ1VkDlQ4v9SucXW0IX2ORO0uCMO5K57wap0twQ2A9VVSXYp9ot+iUUD2qtUhOQ4
nXnjwiaWA526qNDOu5uaBiLTSRTr7QAYejJF+ScYIBPmurByRhVCZwAzSWPbzsDy
J7CExUY1v9Oo7wwSFq2ccGrLFFf+gvLbSMXU5SHFVoFKQ9gO/NSSPEmaz05fkUmK
rpbOpsRyCIWQfofRMcy4wYfjUF2QUkWqSw09JPtAihdsb0bl7cGy4C9NoRXU5aPS
kk6qjds5q69n7pXEMPJfTbUfk3JwB/fErF34Lp87XZMMDm/vvGvCBbYho+REOVwH
fvYFx0/rFMG0TuRTwFQ=
=PXtZ
-----END PGP SIGNATURE-----