A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

# Our security address
Contact: mailto:security@vacationtracker.io

# This document expires at:
Expires: 2024-01-12T11:00:00.000Z

# Our PGP key
Encryption: https://vacationtracker.io/pgp-key.txt

# Our thank you page
Acknowledgments: https://vacationtracker.io/thanks.txt

# We accept the following languages for reports
Preferred-Languages: en

# Address of this file
Canonical: https://vacationtracker.io/.well-known/security.txt

# Our public vulnerability disclosure policy
Policy: https://vacationtracker.io/vulnerability-disclosure

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEE/6igdrHsv1C/h6YeJCVKg46eG1UFAmPABPMACgkQJCVKg46e
G1WA7gv9FwJhjQ0SFgY8nKHJZKgMwRhbg3OcckYHr9XBuEcE6BLEcDDD2T9C4QN3
lE9G/8/YK9gbbnkFxqzNXaH9plKC1mExt6EmRK+6AOKZk4dHWCbSdvDU2cWqrky/
5YP8+Fer2cA1g7iRejbdt+v0D3J/YbMxW7nm2xyrM/t68UmXVBJNGoI/zetTX7Ln
ULzwwG1g7aOSC37/YKOT5YabmI+qefUH/DEUwFhipukgwaA0DwrMjK4P9SSw3WfL
Ig6LxFVzI3DTZcF+95YT5ugMA/XpOkTcPsUyb2AVdnjgXI/Mw+GeSWDnWVJ1I9Aq
R/MgeFzIGvPi8R1L8hFL2qpjkAO0eiG9I/5GJD1oLwUXYC33ODFkWOBN8dwXQJjM
8xIM0eSL5yXyvj7wh2vGSuNX+oQ5Y8NR/HFjvazFrRUUTHP3gxh9GEW0KsYbPbvs
9zwQm/FKsDucfAjxtA5MRJCOky3UDQiDQiJNBh4zabuDRE4PC+ZOBKxE0b0OhgKL
8VRK3QEY
=g2lX
-----END PGP SIGNATURE-----