A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# Preferred disclosure is via bug bounty program
Contact: https://piwik.pro/bug-bounty-program/

# Additional disclosure contact
Contact: mailto:security@piwik.pro

Preferred-Languages: en
Policy: https://piwik.pro/bug-bounty-program/
Hiring: https://piwik.pro/careers/job-offers/

Expires: 2025-12-16T23:00:00.000Z

Encryption: openpgp4fpr:4C75B4E46772504A2CBF4B6D1E6F8507C7980CC1
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEETHW05GdyUEosv0ttHm+FB8eYDMEFAmdhhQgACgkQHm+FB8eY
DMH+lg/+O4QKhcwnUYI3Q3HdlV1z3R9dkOILiJxsW0weP7TvrqhTzwA0gVR0a1hD
6QoxUyWDs3qsB04mVantnpSYc16vhpkRhai93327ix3d9QBbsK4PyfPLndptJFM4
9RbtxQUco5NW3vSpmuNaBJfsEmLEgIIwF87w9qtTtqeb/HKqrL7nuM+2GW5e5GXJ
IgBxM+s1CJ5QfHAKLXTN2+CUiGGSG+9QHzOBIx6HOrJ/opmYGvUhF9Rhq2LYBug/
5i8mlGzInFL2d/o+vBBfecVzd9adfaMk1P3vRFsXETY2cypXiPMjoY8QxvkpshWX
fExGIy1D7yQ6XmmAMw+VK0sL3PM7Ju6qMqft/ECLIDOJmLzXbSe5bXX5ZoWvGSTA
uQOUXcrX36Y2TqXKpQQnQJt7oW1oefqInPCf7HK0hCzJumWxezistlUmIvuZ8mR4
ZP3mduGybpfeX3VJkJaXU31G7hqstgWEd86hFiH/9EY043wMvSKQ4RzFpJk/IUSu
B06MtcNkq2OWhOh5cEiCpYIREwCsXbKS/ki4W49H30mHerOezD5Dpa+f2MAL7lFz
/03e3Ut9n08Q2PrYnUXmJ1RkAmnzCrd3vLJDcc1fXylZTE98NhKzGJKOvrO8JZZv
WmX9Pk4VplhTCCSdFYeLem+gTfI1JUrWHjEoKoNlSsOOHAUdoB0=
=AcxZ
-----END PGP SIGNATURE-----