A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Contact: security-vulnerability@rea-group.com
Encryption: https://keybase.io/reagroupsecurity/pgp_keys.asc?fingerprint=9bbb1f1e7eeb0684a224c8e72880b6418d107e44
Acknowledgments: https://www.rea-group.com/blog/responsible-vulnerability-disclosure-program-hall-of-fame/
Preferred-Languages: en
Canonical: https://www.rea-group.com/security.txt
Policy: https://www.rea-group.com/security
Hiring: https://www.rea-group.com/careers/jobs/
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEm7sfHn7rBoSiJMjnKIC2QY0QfkQFAl4qI0sACgkQKIC2QY0Q
fkTSqw//TrDpIv8UdAJBKLvMw2YQM4/NH8TrQ8BmGSLcFG4r+O0W6NuTazh1wKEP
386jTL/KiWxZQCdgYKVOpbl9Go/N24vEeEE+8fX3fceHPd7WLtWz6nlvYLs8jbFi
YtNxwC3/qpBv3TeX82yTDE5M8G8ivDZ0uZughpZzXJQtr/JJlFSZhCqT29ITYqhD
BItnKR3LqjVMQoRoimWdDTmmk30V5gYdZusvFM8I9QxPAvwd5rJgsKmQMaSmXEs9
GzP92wLByDRN8qICwMJA+sq4W8lvPLcx3du6cgWPDJoer5Hq0WZXRMoTYF9+4pnj
V0lgmBGqzfUA5sL6M47AS5lN389Rz++JBzCkq4QkBJa8cJ/6riUqxT1WLpSlpCxu
6tAnR9fOXRsXLFQAs8nqNozja+zK+NTfsLfqfc0ow4AXJesW/J0anrrBjyaq/2vV
oadVe25d191WQ7hP/jKoqdPHSUKkhheYv8gNtu9KJNc6kWZL3ZJT+ew03qoMrdOF
z9Bice+woAkt/hFl5YByh1K+7knQVCmIqoEbaN2mfIOiAqZMqxkifywG+RFn7hoO
eGYTtEPARPBp/ydLgXil/nMgO2Dce/OfNPyDHFHGZ+BCji3sFM8GlxRw3uV+Mf+n
q9S9tcr0o6pvlA5u4NPe6UcPsE0AD3dq5nD8jW9CkjbmxPoojTU=
=EwJR
-----END PGP SIGNATURE-----