A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

# Security.txt voor merpati.nl
# Conform RFC 9116

Contact: mailto:info@merpati.nl
Expires: 2026-03-18T06:16:29Z
Canonical: https://merpati.nl/.well-known/security.txt
Canonical: https://www.merpati.nl/.well-known/security.txt
Policy: https://merpati.nl
Encryption: https://merpati.nl/.well-known/pgp-key.txt
Preferred-Languages: nl, en
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQEcBAEBAgAGBQJoeea9AAoJEHWPdojmBnPBb08H+wf0ToK74oOR8/Kni+eXaqEO
esqB0+UTs7IskcPt3qvnkfNJViUjX9ex/60k15cwV3fmMMeMhfALOw2Yn2dH7XVj
wbMi/0xPfCE1ImC76f57a3+RcaiU7DOvnNxPELWiaBZslf7Coh0MtSlTycrNXJTx
bk15nyAaLDLevPLZ6GAvFmDPNNUIst2RQAGr3PsE3ylUJih6cne41oypqq5K6H7f
NdeuzeZ+KeIRhXy/4vBu1ZQ+pt/sMmwRil2beodiwSlCkXFjrK7i86u9qTHkgwxB
2QQl2O6t6fv31lx5c5ZQNozJKVWnqtTipzpBy8wHt/HoI34AK2fS5txedGM2oi4=
=snbb
-----END PGP SIGNATURE-----