A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:Arthur.Sinke@stahl.com
Contact: mailto:so@notonpaper.nl
Expires: 2028-03-09T23:00:00.000Z
Canonical: https://stahl.com/.well-known/security.txt
Encryption: https://stahl.com/gpg.asc
-----BEGIN PGP SIGNATURE-----

iQHLBAABCgA1FiEEmZ9n6Bx6ftGYqviMXbhGKvaTz4wFAmQLHJsXHGhvc3RpbmdA
bm90b25wYXBlci5jb20ACgkQXbhGKvaTz4y3oAv/cV2FJ4yn8/t1fa/7mXkEOhBa
gHJqTX+TMH1/1ygjrkVHGXG52Ozdvm8a6HZUilFhJ+tRwSCQzZnzULCzlDFbqPcp
4lCtwZXa+KyF6l77O7x2cT9HU7IRKs629e1aIAdvgzYjbLRabWkb6FYn0aMuOvNm
JyQtGdsq3ALNrSU0jRnWXkXWBI23QZOIsNH1WjEHdVYLxfVrWYdeUTUjMSMYWug8
4yJRG/uLLI8kYtVKLAVpUx2AwtKOZnlexVIWVaewgv7UGNDuwUCy19wRKHjLymKz
jk80SO8Z8+L0bp8wctxJg8QZyMPO/R1+8VnFg0udWLxyTC11AE2eQHy52EVZtyOH
kENAWkTsk4Drih4yPbS/RSrGU6sXctlU4HMIZmblnuipnZX184o9kU97fSS+OZfz
CYcNhpCCq97X/qEo26oyv1dJgH/Mu49pR6dKj8pnfGi5zZySBrgpKs8N6w6thN7H
lRsKR29h4cTinKJJdKLEGDP4COQFeR2/cEkljFq3
=hv9R
-----END PGP SIGNATURE-----