A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:benjamin@heisig.name
Expires: 2026-01-01T00:00:00.000Z
Preferred-Languages: en, de
Encryption: https://benjamin.heisig.name/assets/gpg/benjamin_heisig_2025_90E96BE2A3472B5F_pub.asc
Encryption: openpgp4fpr:0FE396172667D539B5796BAF90E96BE2A3472B5F
Policy: https://benjamin.heisig.name/security.html
Canonical: https://heisig.name/.well-known/security.txt
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEqsL6Rg7NgJrszE+UfkfaiNlFFKMFAmddoxsACgkQfkfaiNlF
FKMKRA//QibsXFrd42okwAMbBsNTNvk8vSur3qDy0mL6Pa8Rooku654RaRlkFlsn
cEtAwQ0m24bakhMa9enF3v8PRC4/Ec9PDsinZh7cIuVbVE5k/0bm6oq5WuWWGnAo
O9DQgOw9ZKBxVSbw4KisYHelsgugxh0IHJayYJrrWsejUDjPSj8rZGsCvLce3dyz
RHzzD6t+YoEw9/Ch6UuQSM1rffTAmjRiSNngNvtVE38/ESmEw0REwCddBHFV67bK
saxucX6eANcYkkxiD4L37W8ldY5Ycz5JUw/F1V3RnSjx+J1Q1O/Btsn+XsyNBYfO
D+ZcxS8bU96Zt9crWo7JyD988d9lXg3Uka73PAeX7yTuTrdPlvHkUz7ArRa+D+pG
Tr4Z3JW0dtmHyZX/x7Tdb+/wpRf8zhOeMdUhNVx5P5NYalhh5Gn+iKzYeI7DnhGQ
8Ctp5TqhW4W4+kuule2tjMcg8tZzTgIPtm+CYDZdIfHTPXtl4+ltU4LpVL+vRpbs
q0P02sewG+qzo75rTdxekad+9fEgBAMWLHHjuLhBKo/q3QunGlMfvP3vuUBDEwBi
kEa3+m3iivdfRX4txOVHliZUXG0GJN3h1U1QxBcYMJp2iLeF+B6ae33jTQIeNflx
DVJtu8aM2D9GlwI6rtcUDDdWJLGB3GG5Ht3wuyMrumYQbCZ5a0w=
=+NEl
-----END PGP SIGNATURE-----