A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# thican.net: /.well-known/security.txt (RFC-9116)
# 2022-04-29
Canonical: https://thican.net/.well-known/security.txt
Contact: mailto:thican%2Bsecurity@thican.net
Encryption: https://thican.net/~thican/thican-485EF628CB85CDD4CB7CFF0D52F5127650733A18.pubkey
Expires: 2025-07-01T00:00:00Z
Preferred-Languages: en,fr
-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEESF72KMuFzdTLfP8NUvUSdlBzOhgFAmJrD2wSHHRoaWNhbkB0
aGljYW4ubmV0AAoJEFL1EnZQczoYQ3sQAJCPIQpJR/obP3hz4nbuMssafio26Z48
V+RiC/xxQ870kJGgdc7aEPm68aR5iXNI+b5bZXUAjqSzQDN5bLnmKEUE6ZD3beOp
DbugS873SHHusCumuu7BuJBdcnDI1K6IHgdZBLFKSHMfN3Pt/VBqxu/Gjk1nE3MG
7/UpfZBUIR5XHo/kyi0b46lr6v8RDBEXZt/lIxJ95u+Y4QxJgwpVb84EJ6pxW7wj
5wi9ITJTLglTKhCt3B8aK++sue85DbT/CKhTjGyx+pnHsO/i0kdCfbIKUHYw0vub
r8OrIfhhvtFPXNU1MO+vQYMSGgl5t7q8pMBTTVvPujb/NYT/7iYB7QL5u8c4LIWX
PiuWb/Sc8OydyQiwRaE1lNs03hzqQ7jMnh5qqNYMDRnYe4zU+57jnvniJLwUch86
1sL7uAbLjPfD0ot4+79zt2z2hO5yQz0DIFi90RYMBF4dfyxs4yiBVGhyGxMhYIEM
i8Su45abYMtF0ej+LuuoJEsfva2aK/lCgatFbQQtXeN3KyE2RgwTcWKxb5n0LxTF
7rBA7D9B1cUzgSlZzPjP5qBzMxN3F4OTa0rBa+kBRudLHj6U6CU9sFYwWwra7G5w
e6gI1YH3K8a52NuLQWniIOrszuQi6DYsncMcpv2NK50Fr0DR84XRHCzzJOa+psGj
yZDugK2Tloli
=J5Nm
-----END PGP SIGNATURE-----