A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

# Security.txt voor achterhuis.info
# Conform RFC 9116

Contact: mailto:info@achterhuis.info
Expires: 2026-03-18T06:17:05Z
Canonical: https://achterhuis.info/.well-known/security.txt
Canonical: https://www.achterhuis.info/.well-known/security.txt
Policy: https://achterhuis.info
Encryption: https://achterhuis.info/.well-known/pgp-key.txt
Preferred-Languages: nl, en
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEPBP+LrJnIKGFjCaDO2S2J3EWhJ4FAmh55uEACgkQO2S2J3EW
hJ5jOgf+Lb05ZjOcKj/J6bzUl+Zt1iDwj/NJp4RyydxOcVmCV47ELMga+gX59mZy
IvF18omp1kARQcrcbMhjP2wGJtbZQJRYwfUARoFF9aFVUROEWQtq+TOrHdHkf/2k
xy+YMe6wRkoGtU1Cde3ccQvJmRkTRQHaE4yVRSRQ/lNE8VU0hJ6XraBkQE6EuBJ2
xXDgykNZJAGDZ4DC+3OFrlBod117lzLMkogDuWsfwdpxI9asljDmkAbtTGaCkuQw
38oVgl9121zy6dj+ugTy7loSXAnY4XsSP6tFdPSf7BQ4LreHePCspoJl9NoBNlzn
8Dcd+Qdt6CZE7ghOW8nXUSzz/nIk0g==
=Sre0
-----END PGP SIGNATURE-----