A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

# thican.net: /.well-known/security.txt (RFC-9116)
# coding: UTF-8
# 2025-03-16
Canonical: https://thican.net/.well-known/security.txt
Contact: mailto:thican%2Bsecurity@thican.net
Encryption: https://thican.net/~thican/thican-485EF628CB85CDD4CB7CFF0D52F5127650733A18-pubkey.asc
Expires: 2026-03-01T00:00:00Z
Preferred-Languages: en,fr
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEESF72KMuFzdTLfP8NUvUSdlBzOhgFAmfXD7sACgkQUvUSdlBz
OhiEdBAAt/QZpVcRNBg1KkEIJZyGbIg847zdadcClEaqSjvDN3xeFLXNyDaJMQ+I
eiItHx3UY8ElfZikLphmXcw5g/zET0/yaxcyXmJcP/CMUTqKMQnqLhPm/Ud9G8Rr
LUwRSbx+g/GMrEbT2yN07YOsuN1ykGq+t5rfTj3s25hbUmnklNdrF0732AAR4iIm
wS6p0f/iz6kUD32sjp/gWJLjy4Yu5dXaQVWLL8VMAE3xYNfU2UomZ5qpUGutw0AX
1SCEhjJ7XYN3Mxau+ZNqIeCU5c7DcjJs6RIxVp0XNLAtoFvUVfTFrl66VHiEmwfc
wkNFIEp5Fb/VoGyasWi0guhLLYP/sTNWUG0LIw9nB3yygQWa3ErJmbZsKCm1+wtS
x45V6d02a+IEzD+h8c1lpqM0QZWZA19yciO4GsgOqdZQVw9KxTJ6164VhodML14c
VfUTzSGP5S0R2oppQ/XtD5PxhFEFIbn97naun7ssanzHQyxFy3/1dF/pQIFPK2py
PWT6RPBRsdzRArvfByXB6IZ5ZHiyTpWZysmzbJEjleoZeNz28LbDIisOYWLFCsk0
TQiR01iw03qRxwgkIWD/v3wwW3CMDM9DDIVxlJoJsF0BHGKHFRhMCkQzh/gWy8he
jNIvzfgQ8rinl0S9kDBpvZcAuT8WihOow6Li+aBI5mQe/JfHwvA=
=BxRk
-----END PGP SIGNATURE-----