A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

# Amsterdam UMC security contact information
Contact: https://www.amsterdamumc.org/en/responsible-disclosure.htm
Policy: https://www.amsterdamumc.org/en/responsible-disclosure.htm
Preferred-Languages: nl,en
Expires: 2027-01-02T23:59:59z

# You can find the PGP signing key from rd-cert@amsterdamumc.nl on our public web server.
Encryption: https://www.amsterdamumc.nl/.well-known/pgp-key.txt

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEhBoCY5ohmpFlADYYRF3VAFy4wYgFAmlXmGoACgkQRF3VAFy4
wYhdMw/9GwlfkllKmND8+kN+sH9nGzzYa5T05cwmdSvt150+3mGuYREG73gjBBgn
mpeEO5y4moWgz0FUQwJcgRRwvkBmyI1rI5MtSz3QYQf2NWoKN78xhwqfITPQDdWa
TJk+krFvU3BHLb94jVu7wqoaz0SFQs3rWtWPmwuDqwBkEX9bKKUUVSbu4yz7FSo7
pqXX2rqQtc+Vd2nUeXX+tqiZURTNa4Bq9B3vaLIlwP1a6tgiR3eyHNuDRVOdMv4y
tIEGD2HxA/TsxqPD9GcpfGr7Pcbd5NlfSyhPngJGjrhfoTeUo/OZu2NyHbKMsQHQ
hIRa0QEbvGAMMPTZSRu9cs3GoeIT3Y0+40fk5lQeT9Xkr8S4IG+kCVoz9leApHJR
VCS6OQx1ySFvLkajZNViQXUlwyK6MHMSMwFmidbbkNZgQsmI98iKm/PTZt7m8zVQ
hzM/Niy3fnWM1Y5jcwurp6XlgQTm5QHgdLyz1g+KzyIq79Mhj8lrNGGZaADc/u15
fcaf7K1xNWC/D9ZmeOEy4Cv1R6/YU1GqPUpeQe9ilQScwLDLU2Iy/wr6qTw/ND7l
HZzUKNWONGhuCGhDDtdq049uXBCHYngJ/3L2l9ECFXyHCHf9xWXFzPnXvmGZQKOy
hTArH5oBZfuFU/DwG6MIatK70YWa2/38lwkBGgARZ2JeeZ/FrzY=
=As+I
-----END PGP SIGNATURE-----