A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

# security.txt — Responsible Disclosure
# https://www.rfc-editor.org/rfc/rfc9116

Contact: mailto:security@silentsec.de
Contact: https://silentsec.de/contact.html

Preferred-Languages: de, en

Policy: https://silentsec.de/about.html#responsible-disclosure
Acknowledgments: https://silentsec.de/about.html#responsible-disclosure

Hiring: https://silentsec.de/contact.html

Canonical: https://silentsec.de/.well-known/security.txt
Expires: 2026-12-31T23:59:59Z

# Out of scope:
# - Social Engineering
# - Denial of Service (DoS)
# - Physical attacks

# We aim to respond to valid reports within 5 business days.