A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# Carefully reviewed human-generated security reports are welcomed, but no
# bounty or reward is offered.
Contact: mailto:security@ivarch.com
Expires: 2036-02-17T20:44:23+00:00
Encryption: https://www.ivarch.com/personal/public-key.txt
Preferred-Languages: en
Canonical: https://www.ivarch.com/.well-known/security.txt
-----BEGIN PGP SIGNATURE-----

iQGzBAEBCgAdFiEE2P9Ep5zIph72lPp+uIPgExTajoQFAmmU01gACgkQuIPgExTa
joQ1uwv+LUpGQhASBv6Pec2Uz+jeS0z778fTHqmPMHRJnqdiLGm8x8P3wT6ItkyU
RSDE+CIih8dEb1x01mcNTrtkNwmOdwvzz4Xsx4fAO8K6GmfIdlUGyKnRn5l5DdVF
QQzWU41kWDnqNUi3xW3VeJB4/6yl6mBMMovabkdoGlTbpYPQ75miu3F2PrfHE7cu
sSBgLZWDBcQxB4I5irZSfobuQ8iqECOtB5CVxoBIjHbRxZ0ciNoEsyv/uv/ccyju
E4kaJV5sQHOdotnsghF3/E2stFz4ZcQnN7PTI9PUlvn1qu6cLlkns4VOwue6KNjl
bEtQAvnzFGW0RN4rEXpU6rNfQNlKkApx+T0pWDmN1Mr6w2pV7dY5aI685qbCKFYz
7vEXfpc3rzarr2/+SASP1uaKolhpNC9UqlwjZ7OL2cJKqtmfoQHtuhNGQv1RVKZB
D+E6wprbCPdKmJUJs520bra54Y671O+XwCP9pyDP98vbeJFVlDkEPpmun8d/PSEz
NlX+NtTU
=swsW
-----END PGP SIGNATURE-----