A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

# Security Contact Information
Contact: mailto:sysadmin@drano.net

# Open PGP key
Encryption: https://drano.net/.well-known/pgp-publickey.txt

# Expiration of security.txt file
Expires: 2036-02-12T18:52:05z

# Languages
Preferred-Languages: EN
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE+dLUgjdKb20TB30YEtS9MbTq4gsFAmmQzOYACgkQEtS9MbTq
4gv/5A/9GpKKzZ0bkC7nTbg4LK0QcsEz9GwtsnynYsOwX4J8qA3zujznnILE9Mxi
9UtbjzQupJaY3huNJwMXRTBDQssAKks+dLzUf4xKA/a+PJ1WgNG+3sRzqcyA++Y/
+LGc11XVkfgRJtp7DAyyZN9/W3l0lB5/6exUX7Y3vjU1njiYiYS/zIT1VH5OESsM
QX8CMiH5qbnsb3uI+dN4Hy4DLBpKWaGdk64sTXnjTGlarUwRoy2ns5MODGC4P3Au
GC3jQb2YY840vArqg9CX4xkDFucjEOmpGQRe2x19wjwrWqo7neRqJ8r2Wls2OgxE
0TTQgpW7x/jxrA0obLsqw74xqhZFOfxrBThG9VRqADHv8bTHqZ6bnWtkAcwlt6Rf
dMUMmlUHIK8CcNJhsY2ZImITpB0MXq3CmLmt6RywCu0HdA2sfn0bcZ5OtpKZmIO9
5puP+6wqOUxpDF6SZ6GfceUxaYN5wKB203ye6hY54ImHTAcmH4QMpM/GXQIzCJjI
+tEfvYpe8CKrPy2J+XNDgfh40D3f4KoRiTCMvNrYmF5E7RqhFc1v+XMVyscUCH43
0Z3PryWoImjSiAij+f68W5+6gRIoLziGn7bLzxmmwmst9tukegxbqMBmGLT+BDT7
J6hJXRY0ZNfTnipEMJ1UT+dxZeiYJlbaWrFedJdWtYpSmXcaYqA=
=fL1O
-----END PGP SIGNATURE-----