A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:security@afas.nl
Expires: 2027-01-01T00:00:00.000Z
Encryption: https://www.afas.nl/publickey.txt
Preferred-Languages: nl, en
Canonical: https://www.afas.nl/.well-known/security.txt
Canonical: https://www.afas.be/.well-known/security.txt
Canonical: https://www.afas.com/.well-known/security.txt
Canonical: https://login.afasonline.com/.well-known/security.txt
Canonical: https://idp.afasonline.com/.well-known/security.txt
Policy: https://www.afas.nl/portal-bedrijfspagina/responsible-disclosure
Hiring: https://www.werkenbijafas.nl/
-----BEGIN PGP SIGNATURE-----

iQJPBAEBCAA5FiEEB/2slRZECAQIoGa8bA2SHQOa1TMFAmlvUiMbFIAAAAAABAAO
bWFudTIsMi41KzEuMTEsMiwxAAoJEGwNkh0DmtUzU0sP/iQUCEIXMpDMu0qxmU8b
+a8AHZX4VmQGUhSZomFPEeUfoHJp51b1qcdyf9/1YDcwVQNUjBcTEYot8N4t1cab
/r2z7BunJ4v0ajxgKKixZnQdh8C2kCQYchyE/NPi9MJq5IdXPea2fvDHQOh54N3d
Lt7dBsa9/Bj4RytdBrxdiWhABIs18vYhC2nP7lD+t3MET60vykObHaNRtymbZIqH
fh2Z84EBzc1qPqSn3eN9tlz+cZKXHQu5FXsXkSMh5R1U+Z95ejO6inepBtU2jLjf
rNVjFKRrCcxU98rpv3inD1kZUF2yyfUHqByGWfXW/I7joF8pKt6tghTlo0ef33C5
LlHzVbkHpzRL0zQu3f6K7R369eMmUG9FDtugvTArszpPur7ho1EQMjdIJilwoXt1
0C7aQoEaJ5bbuxLLxG6s310gqpZ4kOs/rNlHIpRv8mlIpEE9lNV9kWsfjFZJE5b5
arCSu+iepD8kfTo2p15Al/CLCcHw1B55N7EBiANx+nsjbNRQWJvDBPjJN2wkXUsh
rXfrrPoGZppcQm5/kyBSjdjVJqyttjGG0p3INQUAXIPnknrg2QahqKRFso0iOWrs
M+I84RM/e+EqjUa4Hib52y3M2Yg3VdQWaLL/GOecsm4yEOIhO6DcGEshd1X0FC4P
JyQBAGFyvLRmGT4aYwfqX15L
=g8aF
-----END PGP SIGNATURE-----