A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

# Vulnerability reports should be sent to
Contact: mailto:productsecurity@netwrix.com

# Please encrypt reports with this OpenPGP key
# This key was also used to sign this file
Encryption: https://keybase.io/netwrix/pgp_keys.asc?fingerprint=e9408e791451ac20cc1ad5942304ffbf10db3d09

# Please submit reports in English
Preferred-Languages: en

# This file should only be trusted when located at
Canonical: https://www.stealthbits.com/.well-known/security.txt
Canonical: https://www.stealthbits.com/security.txt

# The information in this file will be next reviewed by
Expires: 2023-01-01T00:00:00.000Z
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE6UCOeRRRrCDMGtWUIwT/vxDbPQkFAmGVa2cACgkQIwT/vxDb
PQm30xAAn9tJ/2ivtOZ7tFBHOhqmkpjN+oL9guesH8zSu/pQbi3YY3ybwslBbtbm
/PQ4h6AKKTTVTPGluKea8zNGCX57JTWWWQUPX+fngiLN3L/PLU59RdQFuC6x75Ak
72ynRFM8r317BVW30dAQFodfy0Anrz67L5SNkWpymAeZWU2ZyGgRVG9g/IHJJF6u
HvPHM9ONtnADPiLXt4HQetQefabtKRxgdeYZS9JqMTL4o+idquBVyJ/cQQZRd5rn
9w0uQRcI0fJ6B8v+dWjaX/1aUc3OQvDe2BBTbrXDxoz8bGQticMgPYJcO+X13e+y
cv/rQmpWCVyAmcQwn4AIPGPeRTJpCIHgrAnI4vNOmG5+gHXCbR6YJhjLJAH7TC6L
9VaushE04omRMTJ4rrYibOR/S/Zbc0SrPUAaVp6oI4QH7MPICoN5TFy/w7tVGk6y
/nm14hEC1ol6QtYbQsokW/DX6Yz3LV8wjKozSbfkGUB11LD1SfyHbG3ZGbLZ862K
sWGNNktwmtUILXY/yXGyC9RTpOA67ZGasUtGpCe+dGRnlkO4Qpn6LRpN7t8vjQV2
/meZcPZVVmxe/lL8kSa/zwO1N1IE997hSJnImFk8gvJjbsjqymSes2WndlgUR0XH
0HbBrQqhhgyOMPpHYUbpnjLGzm24D/tGv2IP20CdHBsvSRXqltk=
=A3Wm
-----END PGP SIGNATURE-----