A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# Our security address
Contact: mailto:cert@enbw.com
Contact: https://www.enbw.com/cert/contact.html

# Our OpenPGP key
Encryption: https://www.enbw.com/media/enbw-cert/pgp_public_cert-enbw-com.asc
Encryption: openpgp4fpr:C18139D73410A2044800270EC5060B5003FAAE32

# URI of this security.txt
Canonical: https://www.enbw.com/.well-known/security.txt

# Natural languages that are preferred
Preferred-Languages: de, en

# Our security policy and process for reporting vulnerabilities
Policy: https://www.enbw.com/media/enbw-cert/cvd-policy-de-en.pdf

# Our security acknowledgments page
Acknowledgments: https://www.enbw.com/cert/hall-of-fame-1.html 

Expires: 2026-02-24T11:12:25Z
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEwYE51zQQogRIACcOxQYLUAP6rjIFAme9paAACgkQxQYLUAP6
rjKodw/+OTieCilvIqtG7483BcJlWdCq9ebxfzMoQXBjeQhyb0OTF+WWafY47IHi
ozmTU3f3Of2mNqD7iZdIuH435oW2LAEDqscyY8haOYAPXsvjr+MmiCWUWTaoB6Um
b+Zt1CzifZ9Xw56omTY0yAIn+9UI1m+QJKvjK0TUFi2hZ2GfE7FZusJHyZxK1d+3
HlW2yr97ldHhdRx81jVPp9RH1aJi/BcjVxJOOpQyDv2myfHKzcfEMvSLy/uaXEwZ
+YGYzjxyC/HiHo5DlDIqkFNs4Lmr5uNb5jee5gY15v0L1/cPBxOy+tcKvf4khraF
y2Q58swWgYz/EHrBxdRQZGuqJtHrdKhEwsBIyUYGuY2q/2klg+qYc8eUbyik42bc
V3jmLVoYaxKeFsF9eJZnMOgzLFaPVTJcGCmKo2I5Z0Dt9GXoPoi7cFFERlzgoYoc
hPLgGBSiDoS/yAG74RPkqCwRPt3Qj+pC6rIIwbQN+ZLqIz4r4A94voJT05TMH153
+QLmMKX02+A4s0lrgDfOLGslDKySwb0LVIcgR8vHoO8oy8lTixa1oJuYYQ5DPsce
Cyoz6Ab2Khtqzp0zGBhOzVb1+UBU4QnZbciBHDEykZNriFqJsBSC0xBtTF+5JHr7
1lU9DNFS4MyoX+u8uLLyr2QUHrkY0uLtm5FrV8k5gDRtIaBY6iE=
=3RN8
-----END PGP SIGNATURE-----