A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:cert@bit.nl
Expires: 2026-10-01T10:00:00.000Z
Encryption: https://www.bit.nl/uploads/pdf-files/pgp_cert_bit_nl.txt
Preferred-Languages: en, nl
Canonical: https://www.bit.nl/.well-known/security.txt
Canonical: https://portal.bit.nl/.well-known/security.txt
Canonical: https://www.bit.org/.well-known/security.txt
Canonical: https://webmail.bit.nl/.well-known/security.txt
Policy: https://www.bit.nl/en/about-bit/terms-and-policies/responsible-disclosure-en
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEN8NtfrQaPgK33d0EncpKl6gOd7EFAmjT7cIACgkQncpKl6gO
d7H8rxAAgukafB/jRVsuCtWMpTNZ/Kh53HUQTQPh2DNebkxZFL84mLriIUIZIjiu
v8ZxAG7xkoeElLFccMRW59uRzZa3pqXLRSuzUSY9wMl/hFUQCU982M0CCu87T0xZ
qRisfNibCa6SV+OSdvhYAURKJbp6DPOcm6QqYo0pwKlYmDXttgixXkcEjDuvbtVi
Q4bM34oV3JR54QZ3qHlx0c2vZgXlZ9oVB1L7aRAn0TymMYMiqXqTdtCg8umWcljE
FeeNhSVXYRpQ50bPrilxtxwT/mDsmz2hm6UIqGYsdx0uNto0VYhpldpaNzYvY3g0
PspLKVQyxXB5/cNQcAfOwypccLTjmxrlDxlj68C/f5FE7wicFZWp8dRzd5w+Yr0C
0MDuqFFezwvnI/rHL6a+XtccH0lX7SmMln3YR0pR9Gc8olIPtn78dHXkf2R+1odu
W6OaAz+/B/gY/4CBv9Ov/yinN1l9E1eAi5jKj9d9D114ZKzqem6dDwdOBd+IXHfh
Vl+u0Serd1/Xxv6ET7rI2wRMtGbifseVmb6ln2BMdMBg2KHqGsJfpc6iFdQDWd7R
eQ8rgNRTZvIS3gMdCjMiZJEziX3YCqj21ZgVu4RjuZvgTY9tXMZ0oaZctk1ilwGj
0R4y+JCKQAxpoMMrSAaLTh/NtQNGOenLA/GtRj72XSspu314OLU=
=ezy4
-----END PGP SIGNATURE-----