A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Contact: mailto:cert@bit.nl
Expires: 2025-10-01T10:00:00.000Z
Encryption: https://www.bit.nl/uploads/pdf-files/pgp_cert_bit_nl.txt
Preferred-Languages: en, nl
Canonical: https://www.bit.nl/.well-known/security.txt
Canonical: https://portal.bit.nl/.well-known/security.txt
Canonical: https://www.bit.org/.well-known/security.txt
Canonical: https://webmail.bit.nl/.well-known/security.txt
Policy: https://www.bit.nl/en/about-bit/terms-and-policies/responsible-disclosure-en
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN8NtfrQaPgK33d0EncpKl6gOd7EFAmbxYMQACgkQncpKl6gO
d7FUexAAjg4aWxMim9QGayjWuTTJTlgj/fG2IT3AwpkXF3ADLsrs6al41Tv3RBMs
nCNFFpDDanabiQQ/dAMCeNMEdd0XGhSKpggTqcCQkc/TZBzDT4/9HLMmUpBwSux9
jjbXNC3dSB7Q0IVGjzW+FN2hzAQGVJHmspX6ABtq+qVCxSs5E2v6VTn2efRmD3z4
9xR489lUVukQrbHgeKtVOfQQgYTbAiUjc7+iReS0pQNlTwNVELqjHLZ2vICrLxIr
js1zJwTo+Slpkb4mqFVltFc6wx1P6HfjSBrEFlJkoxkYb3buPNUVzqrzq2WRTvZG
ATsCW/PvoHcyg1yIEUbiwCtyPxrE+qSc2mtKGRXaB88WEkYQFrgS6etLMIZDC1UN
e8E/+26+FPL943ABpj7vPPJisxFB2CwCHDkp1Dib5Sa2+p4CHnY47myapzqf57bQ
GhUASpS2ZaHM4Z2iBUWvPNGMp9d1PKYDbwnuvuyRf2KVPzmUwSpB1+MUaNXKTZZF
sDN/UHt8bXTIvaCKOjQUoy0QbWAlG/F2LG86xmI2cM3gvC7n2jnHPqK+7hW98Uha
LuzL+0ihNjzDwayMC1nvgC24LJXzOF9NVaDbbwAWAAFtNa8V2gHYu2eCzOHMUqqc
e2xYEQuVgKQTs7CYtmHNhZyJ5cMM96lq9rBUzLNONKvM0Ij02hM=
=LDJX
-----END PGP SIGNATURE-----