A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:security@trekbikes.com
Expires: 2026-02-28T15:00:00.000Z
Encryption: https://www.trekbikes.com/.well-known/security-key.txt
Preferred-Languages: en
Canonical: https://www.trekbikes.com/.well-known/security.txt
Hiring: https://www.trekbikes.com/us/en_US/careers/
-----BEGIN PGP SIGNATURE-----

iQJLBAEBCAA1FiEE5DUqEMTkcHvVQeHH0xEDpYO42y4FAmevpxgXHHNlY3VyaXR5
QHRyZWtiaWtlcy5jb20ACgkQ0xEDpYO42y4Wbg/9GDN7zAYtJBxcWvl84Yn5/1f4
OTynUu4TIFZhHckqiB96rhE1A0GEdZ7wzLTtV17TeG4hqDXtSsRadIny6n2vGbVR
QOmfqDXkyYOROWrdL04fFnEQ7U3qA317OfiotpZ30/h8/hfqwhEwDAqbfTVC98NC
v0K6rRCJpMhnMg6jECWAIoO/bTrVehDHHkPHMHZw443wLlcyw0VU5OobGm5pUoiI
9roC2jB3klpLJsQHdwCLUKLNOJLlNPiLAdD5/JuX5ScP7LNGSTWFmj3A22h59Iri
gKU6PPxpi3XIWX1WDGjjCavtlrdCTUm1xNQFhvMvELwH7UKVuQS2hd2zsW3JGHtV
yCUWuYPA/RIEnxzwEaJSHYNop7lSMX4emssR5q77aBUO/xFXISZvB3S5rSO63fJt
wlu3H/T+n+tjAfGAULgAmjtP/L3hPQtf//4GfExJwQhLotiHpyyh8utz3V5Ab6eC
v5kPVbawJWoVdwfPgh2Tgh+tTITsraWiv64Lx1q96EfXwfb7sqAIpyYlc8tuTet1
exTaEcwSg5yxXsEafbdpopUIgcM2mkzqF7UfD8fDsZImWiMEFL2nwy32ti/cftNY
Zc4Wp5iqW6fu2ddJ2xlzo0kKhg5Vl4QlCNZGZH93DGXupq7cCnXDDE9Fuo51vGWU
B3Y3PUxFLzXAp1XBlTQ=
=8jO9
-----END PGP SIGNATURE-----