A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

# Sentry runs a private bug bounty program using HackerOne.
# Please send us an email if you want to be invited:
Contact: mailto:security@sentry.io
Policy: https://sentry.io/security/#vulnerability-disclosure
Encryption: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x641d2f6c230dbe3b

# Please refer to https://sentry.io/cookiebounty/ for details on Cookie Bounty
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE5AbCeulxZRWhse2GZB0vbCMNvjsFAmYhkjMACgkQZB0vbCMN
vjvEzA//UoHN1WN3fXHIGHfKirgPnIidnS6KrthYAXkTMYU7BNZLl31YCq2SVyfL
IfZEwK2dgqNZI/WBxySdj7STFAVeskYP8dgAqkkM/Nc+I1KL8g4co6e3xRdtx/8W
kK1Yn3F3f769tbAcBkX+UYCebLrcgB8akllp+q9x2s/0kYiW/NbL7Q5epdK9kdg4
2p99kS1zcv01U0XUlmUU02cqxcqbj7H4GXKhTbtyEMH7xbLfoSbftgRXZVGxxLAb
AF3+M5zRpBAfLnDxGGb2rj7hC12dXbGgH0PEWQX0Lj3cfde7nHySHE0SUFfAWDTg
gMRmTUgzHimyeFZ22ndFwJJOXny+t+BCMYj0QcCrddp4o9LuHq5Ao8n8yUd3syfE
uPj8GhK15E6rwewyRodKQXzN9zZrCpVMizfLLQNsGDlqr28Yfh+rxiLOC/gvceH1
upyFS5kYr9oGA9rLqnrw2KByhzm+t1EHro1Wkv58eVbMJzJ5HmH/D8OXU+9XwyqX
ZRcT4CWSEobXpytX8JR6EanEHZYfTw93o+EcuwkuZO5TYHY+pWPF1MQmy3XUHS98
rxG3qWbgPqJwIB7fCnASoRqrpYz6p6Eq6Vt1TDwaXO1I/uC3lAmb477lyNe2RLIg
Yei0NogNpSgL/Xa1RUTKdeC0NLDo33PIlMHLXPrQ39vEQ+DwZZY=
=LO/F
-----END PGP SIGNATURE-----