A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

# Canonical URL
Canonical: https://bendingspoons.com/.well-known/security.txt

# Our security address
Contact: mailto:security@bendingspoons.com

# Our openPGP key
Encryption: https://bendingspoons.com/pgp-key.txt
Encryption: openpgp4fpr:313072CDBD7CBF908B0DDCE70AE5B4D9EAB6C029

# Expiry date
Expires: 2025-12-02T00:00:00.000Z

# Preferred languages
Preferred-Languages: en
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEMTByzb18v5CLDdznCuW02eq2wCkFAmYeZhwACgkQCuW02eq2
wCmOrA//c1oLIx93UTzawvYFu81gXqGl4rvLNzw6w8t3uH6BWePUtXLmc6kxkKz3
HgK9KX0/DPWb3t3s9pDEc2L8I7yBOEh5R/zWY2cccl12GXhKb8u8pDBniSgWcz1y
rhonbLi7PWmKJNz0iXOQ1+6we4LWxAHy7z/FWT/lPD6iTK9GR+BTb5TBjTAqbkLe
wEFC29iQvJZs0Az6zSo4TO2h1nXituJO0jskrxLgBvQTAeUWMqDFVReg2TpSCIv3
yz2kyNm7mzCKR1KaOEGIDKvs81pOWJbIGBhppgzMZajUQnaFBJQ3IerhZJZnL+A2
Vk5xJs6+t8aFRcbGdSqxb8Njwp3eTGLlaRQ2SuXuLayJ3bFrS4EcvYysjxUtCi4X
QcQBjNsDXoaxp33O2um7j03zfaldDIVnXMI9UiimOQgxNGQg2ux7pUdbTfktDxkq
7LIRooU2KD7XS/cpcAL9eO2FGwB5VOHMI38AbLlGFBqcIQC5Qb4ls/1SAAI6LtOD
6ii6/xxSh3DoaV+r9JzMaJITOl5cF38mKPcwU/k47SsHCIcKO//SUcX3gdvih1v4
frpBAU1rgrkseurtEvnVaZP/7OhWTN15DbMWXvv7c/XloMKPYOPvIy38couH2nHO
XrPX7oKkl2p7+BPLKru7DpRBeSbv03CemrJBW/yzEIiaPMLhhLc=
=oo4p
-----END PGP SIGNATURE-----