A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

# Security.txt voor 123-webserver.com
# Conform RFC 9116

Contact: mailto:info@123-webserver.com
Expires: 2026-03-18T06:15:53Z
Canonical: https://123-webserver.com/.well-known/security.txt
Canonical: https://www.123-webserver.com/.well-known/security.txt
Policy: https://123-webserver.com
Encryption: https://123-webserver.com/.well-known/pgp-key.txt
Preferred-Languages: nl, en
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQEcBAEBAgAGBQJoeeaZAAoJEAW3C+2D9zW8AF8IAJq4Jkd3Qd3jr6M0gReb7b5j
jKTf9DM7aHNR5MQdNHlk/o4LQ45pQHvRhCRH4xY4LCfkc8bxrNrRuqj4BCW/6+/X
B+MtcBxll0acIn2ou10Q1Lyv+uxl9f4pxuzNpIbGb/sjz7yZ//mKM2r0E53IY10B
haDY3lByZXJEIW730zzQGXiTWkEC9XRq+BQcIWhv+HbzHWmJ4g8i7WgA5u6B41tQ
l4pg/3MTRhyvlFDiULdGnQyUj3TrRyRe8aRfx1ulophgCvmb/VL4NPS3/gL2eFF4
Wc/9nL2w/9UnTI2sZYKRkjbhcXUWkJ1bWAs8uYILMYfeQ2VVZbrh2jyd6xvq+yE=
=aaex
-----END PGP SIGNATURE-----