A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

# security.txt for Quantum AetherDynamics Institute (QADI)
# Spec: RFC 9116

Contact: mailto:security@quantumaetherdynamics.org
Contact: mailto:david@quantumaetherdynamics.org
Contact: mailto:james@quantumaetherdynamics.org
Policy: https://quantumaetherdynamics.org/SECURITY.md
Acknowledgments: https://quantumaetherdynamics.org/#acknowledgments
Preferred-Languages: en
Canonical: https://quantumaetherdynamics.org/.well-known/security.txt
# If you later publish a PGP key, add:
# Encryption: https://quantumaetherdynamics.org/pgp/security.asc
Expires: 2026-10-01T00:00:00Z