A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

# Responsible disclosure form:
Contact: https://docs.google.com/forms/d/e/1FAIpQLSffWsfEo9aTiAoV_W9ZTAz5_qZ9Iiy2b6z4HKnoRqZDBWOQtA/viewform
# For all other queries please contact:
Contact: mailto:help@ortto.com
Expires: 2024-01-01T09:00:00.000Z
Preferred-Languages: en
Canonical: https://ortto.com/.well-known/security.txt
# Policies
Policy: https://ortto.com/policies/ResponsibleDisclosure.pdf
Policy: https://ortto.com/terms/
Policy: https://ortto.com/privacy/

# Bug Bounty Rates (as of 24th February 2022)
#
# Per Ortto Responsible Disclosure Policy:
#
# | Severity           | Bounty (USD) |
# |--------------------|--------------|
# | Low (0.1 - 3.9)    | $100.00      |
# | Medium (4.0 - 6.9) | $200.00      |
# | High (7.0 - 8.9)   | $1,500.00    |
# | Critical (9.0+)    | $3,000.00    |