A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:cert@bit.nl
Expires: 2024-10-01T10:00:00.000Z
Encryption: https://www.bit.nl/uploads/pdf-files/pgp_cert_bit_nl.txt
Preferred-Languages: en, nl
Canonical: https://www.bit.nl/.well-known/security.txt
Canonical: https://portal.bit.nl/.well-known/security.txt
Canonical: https://www.bit.org/.well-known/security.txt
Canonical: https://webmail.bit.nl/.well-known/security.txt
Policy: https://www.bit.nl/en/about-bit/terms-and-policies/responsible-disclosure-en
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEN8NtfrQaPgK33d0EncpKl6gOd7EFAmURowYACgkQncpKl6gO
d7EqSA//eHfvZp7oUH/nC44F2LaRdc6h0/wWfYuUyGBT1D8sdLsWMT41hcsIKjgk
YERgo1HybZMGivrRKqGiGFO+7+sa3hSal5opipVsYnZZfTwUau3Q6OPtUwWqeRr3
twnXw6uIWHcpdxjyhqOCmQ5ASOOF6loFGfbEvJK+MvV5AgbhZwB9IPLR4+2wAugO
7Yo72T/jTYQORLpLsOTu3pDUxw1Z68tuWEuD1Cshqw8QsBcyT9RohZb+gq+FdMXF
QhbcW+wr/t419Ps2Vdbz7KHk/lskxTcpXeJkjxGjQjylHAK6nNc8raMnwVwTFZjy
J393qBVN2Nxy9tZ5jQHlEkipRVVHWQjZhSzSBSOqqh+L/M/rhZsz7R5EPjiwqe6M
UAuhZm4/GYLdN0vFbbiPs/ZiBqc0Ke4PtsARlYgden0URFfvaoZmt1EwWj2frsYQ
YN6FjPutu/0Zx1HRr7Rqz/eNFLwrhCh4C3AcUWZjCFyXlb62DDBg1fEeDB7cpnNE
/GIIad9FzMjylnj+PAsVGKJV3W/eayY9mB0LYKZTKoiDB9WcF9Pp0ZsbuDSfdwWt
sSowc0jOUxhPfCopac87G0qyqeT/vsxvP9CMfebdorMx+NPaJopgzW/zHJu65yjE
axioGtkFNUJ9srkWMwKvM24lhe3nhnun4M5DpWJaduKl6/areWg=
=12PA
-----END PGP SIGNATURE-----