A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

# Informational
Expires: 2024-02-08T00:00:00.000Z
Canonical: https://www.engie.com/.well-known/security.txt

# Our security address
Contact: mailto:cert@engie.com

# Our PGP key is available at the following address
Encryption: https://www.engie.com/sites/default/files/assets/documents/2023-02/ENGIE%20CERT_0x6B412284_public.asc

# Our preferred languages
Preferred-Languages: en, fr

# Our job offers and hiring policy
Hiring: https://jobs.engie.com/

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEAdfgbWhkgJPa2vfnVD1GOmtBIoQFAmPmJQMACgkQVD1GOmtB
IoSX8g/+McaPgZu8piEA1G47iupz1PXIln2gq5xpNXx5UIwkABCzbPHYylyA7g2K
XXFwtjPoE3AtAq3YTMNIpXFFku/FGe9+2+z/Q7lMObXKgcE3SFKQlWTBzVgs9/1e
h+UnmEIzmSZqdrgTceS/SAZZVau7LEBu5ZyMbV8RyvCQojls6x1u4hIKx885Y0MT
4U0moEDJqCahmuOV5g8C9p5O+0bTWPWA8YzCI+ue3xTeeMSC7kcS9xA5V0d0jfLz
WLPg/CEXE24T7mzAOn/HrA2uXJeb5c7taRH5/T6HQKB5FqzhLDRL2PPohpUsDs2t
zafbFFexQXf2T/OClqvxuWOZeK132aZ5GSxRAIQDCI86DnibFq+TLZ11+iyWTR10
Xzx9XlJUY8bIKSP6RbtORQ6wI7V1GVlzTz7WX8pjWk7edPTqNCch6nyixiUiJXb/
Of1rGXKk7qQFKl+NnmE32qU4HJtCSWVgpRKobLu6xn1zOf8xQ8erg14iF8o/Q6B7
ZwWH+hkMGpVC5fJf3L4AiCRxGyKr0si0oyYqB/ATT6t/hIfGICKZQ2fzSAOo7rV/
SyfmVKNQ6qVFmn2IgsVCLjmxFrsDDNRKT1O3yvlFpX5Vc38vC2lJTltizhrrCYmx
2Jx+XIyFC6UcTflaYdlwqjiZkBVs6nlLYI3iNLv5M00gZuvj3dg=
=MBBl
-----END PGP SIGNATURE-----