A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:security@octopus.com
Contact: https://bugcrowd.com/octopus-og
Expires: 2024-05-31T01:05:00.000Z
Encryption: https://g.octopushq.com/publickey
Preferred-Languages: en
Policy: https://g.octopushq.com/disclosure
Canonical: https://octopus.com/.well-known/security.txt
Hiring: https://g.octopushq.com/jobs
-----BEGIN PGP SIGNATURE-----

iQEzBAABCAAdFiEEvKQyVkSIckQvOwP3lphS92OVTmwFAmR5bUMACgkQlphS92OV
TmyKGQf/ZukL0T0nHLjje4UeK8pftKBpfjP9iJ8X4Jdnktm2X765uWid3hPUQmFj
DofhXJGeG5oRf4BP6zRhFvtwW9YrGPytad5zQsAIG0aTow6znljdhrQ/AsBYJv97
qsPRaQfbgvSauwTx9mEUeC4Q8QK/yu08J6V8+DiTTNp1GbTvbw0p5CY+txvg5Wsm
EtDc4+EB8mYUe+EoQJf3Je7IB4ailtLrcSPAtNSP3n6jrZCyxtSNQKNueEIo0AN5
o6gydOxyAQfZjyBJhsvfqapZY3k97wdTfG9Yl+b4/wRo9ht+8fEuJNIYCCI+cgU9
YRg5tDDGDDHn/qFpXDaItRy0MjbgKQ==
=CvLc
-----END PGP SIGNATURE-----